README Glassfolio
Privacy Policy
Draft for review. This page describes how the software works today. Items marked To confirm need details from the project owner before this is final. It is not legal advice.
The short version
Glassfolio runs entirely in your browser. There is no Glassfolio server, no account, no cookies, no analytics and no advertising. The page talks to one outside service, GitHub, and only to read the data needed for your README or to publish it when you ask.
Who runs this site
README Glassfolio is an open-source project published under the MIT licence. To confirm: the name of the person or organisation that operates this website, and a contact address for privacy questions.
Hosting
The website is a set of static files served by GitHub Pages. When you visit, GitHub receives your request like any web server does, and may record technical details such as your IP address. That is handled under GitHub's own privacy statement, not by Glassfolio. To confirm: whether the site is served from any other host or custom domain.
Data the page reads
When you enter a username, your browser requests that account's public information directly from api.github.com: the profile, public repositories, their languages and topics, and recent public activity. These requests go from your browser to GitHub. Glassfolio does not receive or keep a copy.
If you add a GitHub token, the page also requests your contribution calendar so it can show a full year. That calendar follows your own GitHub setting for private contributions.
Your token
A token is optional. If you paste one, it is kept in the memory of that browser tab and sent only to api.github.com. It is never written to browser storage, never put in a share link, and is gone when you close or reload the tab. The page ships a Content Security Policy that blocks requests to any address other than this site and api.github.com.
What your browser keeps
- Your options, such as design, theme, job title and skills, are saved in your browser's local storage under the name
patch-your-profile.v1, so they are still there next time. "Reset all options" in the studio removes them. - A version marker is saved in session storage for the current tab so that, after the site is updated, the page reloads at most once to fetch the new version.
Nothing else is stored, and neither is sent anywhere.
Publishing and daily updates
When you press Publish, your browser uses your token to make one commit to your own profile repository on GitHub. Your README and its images then live in that repository, under your control and visible to anyone who can see the repository.
If you turn on daily updates, the commit also adds a GitHub Actions workflow and a copy of the generator to your repository. It runs on GitHub under your account, uses the repository's own temporary GitHub token, and talks only to api.github.com. Deleting the workflow file stops it.
Share links
"Copy share link" creates an address that contains a username and your option choices, so anyone who opens it sees the same setup. Share links never contain a token.
Children
To confirm: any statement about use by children, based on where the site is offered.
Changes and contact
If the way the software handles data changes, this page will be updated and the date above changed. To confirm: how to contact the operator about privacy.