Privacy

GLYPH reads your GitHub profile and public activity statistics, turns them into a card, and stores that card. Your card is published at a public URL. We do not store your code, your repository names, or your GitHub access token. Your stats are sent to one third party — Anthropic's Claude API — once, to write the three lines of text on your card. We also use Vercel Analytics and PostHog to understand how the product is used.

This page describes what the software actually does today. Where something isn't built yet, it says so.

When you sign in, GitHub asks you to approve these scopes: read:user, user:email, and public_repo.

public_repo cannot see a private repository at all, so “public data only” is enforced by the permission itself, and the query that reads your repositories asks for public ones explicitly as well. GLYPH only ever reads, and only reads aggregate numbers: repository counts, star counts, primary languages, and your contribution calendar. It never reads file contents, commit messages, issues, or pull requests, and it never writes anything to your account.

Private repositories do not count towards your card. If you signed in before September 2026, GLYPH was granted the broader repo scope and your totals may have included private repositories; they are recalculated from public data the next time your card syncs, and you will be asked to approve the narrower scope when you next sign in.

Five tables, and this is all of it.

Your account:

• Your GitHub numeric ID and username
• Your display name and avatar image URL
• The email address on your GitHub account
• Previous usernames, if you rename your GitHub account, so links people already shared keep working
• Your generated card: archetype, modifier, rarity, and the three-line description

Your statistics:

• Total contributions, current streak, and longest streak
• Total stars, total repositories, and follower count
• Language breakdown and top languages
• The date your GitHub account was created, and when we last synced
• How many of your public repositories have a README, a licence, or a deployment — counts only, never which ones
• Whether you opted in to the weekly featured draw, and whether and when your card was featured
• Anything you chose to add in Settings: a one-line bio, up to three links, and a card atmosphere. The bio and links appear on your public page
• A cached explanation of why your card got its archetype, derived from the numbers above

Your forge history:

• A record of each time you forge a card: the archetype, modifier, rarity, description and contribution count it produced, and when. It lets your dashboard show how your card has changed, and it is deleted with your account.

The December waitlist:

• Your email address and the date you joined — only if you type it into the waitlist form on the home page. Signing in does not add you to it.
• Whether you asked only to be notified when the waitlist opens, rather than joining it, and whether that notification has been sent.

Feedback you send us:

• Whatever you type into the feedback box on your dashboard, stored as written — only if you send it.
• Your GitHub username, and the archetype and rarity your card had at the time, so the message has context. Your email address is not attached.
• Which option you picked for how you found GLYPH, and the date you sent it.

• Your GitHub access token — it is held only inside your encrypted session cookie and is never written to our database. Signing out discards it.
• Repository names, file contents, commit messages, diffs, or any source code.
• Anything about accounts other than your own.

Once you generate a card, it is published at theglyph.in/your-username and anyone with the link can view it without signing in. That page shows your display name, avatar, GitHub username, archetype, rarity, description, and the four headline stats.

Your email address is never shown on it. There is currently no setting to make a card private — if you would rather it not be public, don't generate one.

Five third-party services receive data from GLYPH:

• Anthropic Claude API — your username, archetype, modifier, rarity, total commits, longest streak, total stars, total repositories, and top languages are sent once per card generation to write the description on your card. Your email address, avatar, and access token are not included.
• Vercel Analytics — page view and performance metrics. No cookies. No personally identifiable information. See vercel.com/legal/privacy-policy.
• PostHog — product analytics and session replay, used to understand where people get stuck. Hosted in the United States. It receives your IP address, browser and device metadata, the pages you visit, and a replay of those pages with every piece of text and every input blanked out. Profile URLs are redacted before they are sent, sotheglyph.in/your-username arrives as theglyph.in/[redacted] — that redaction covers the page address and the referrer. Replay runs on every page, signed in or not. It never receives your repository data, your card’s contents, or your email address. See posthog.com/privacy.
• PostHog also receives two events that do name a GitHub handle, and neither is about who is browsing: when someone’s README badge is rendered, and when a GLYPH widget embedded on another site is displayed. Both record whose card was shown, so we can see which badges get traffic. Neither records who looked at it.
• Sentry — error and performance monitoring, enabled in production only. When something breaks it receives the URL you were on, your browser and operating system, your IP address, and a trace of what the page did just before the error. On a small share of sessions it also records a replay of the page, with all text and input values masked. See sentry.io/privacy.
• Resend — the service that delivers our email. It receives your email address and the contents of the message whenever we send you one: a waitlist confirmation, a note that your card is forged, or a note that your card has been featured. See resend.com/legal/privacy-policy.

GitHub is where the data comes from, and our database is hosted on Supabase. We do not sell your data, and there is no advertising on this site.

Being straight with you: there is no self-serve delete button, and no automated way to request removal. That is a gap, not a policy.

What you can do today is revoke GLYPH's access from your GitHub authorised applications settings. That immediately stops GLYPH reading anything further from your account, but it does not by itself remove the card and statistics already stored, or unpublish your public page.

To have your stored data removed, open an issue on the GLYPH repository and it will be deleted manually. A proper deletion flow is planned.

One cookie, set by the sign-in system to keep you logged in and to hold your GitHub access token. There are no advertising or tracking cookies.

If what the software collects changes, this page changes with it, and the date at the top moves.