Privacy Policy

StackStory ("we", "us") prints ship receipts: a summary of what a developer has shipped, counted from public GitHub data. Builders can claim their receipt to verify it. This policy explains what we collect, why, and the choices you have, including if you never signed up and someone printed your receipt.

1. Receipts (anyone with a public GitHub account)

Anyone can print a receipt for a public GitHub account by entering its username. To print one, we read public data from GitHub's API:

• Profile basics: username, account ID, name, avatar and location.
• Your public repositories (up to the 100 most recently pushed), their website links, stars and languages.
• Public commits. We read up to 100 recent public commits to count things like commits with an AI co-author line, commits after midnight or at weekends, and one-word messages like "fix". We store the counts, not the commit messages.
• Whether each repository's website responds when we check it.

Each print is stored as a numbered snapshot so anyone can check that a screenshot is genuine. Receipt pages ask search engines not to index them. We only use data that is already public on GitHub, and private repositories are never counted.

Hide your receipt

If it's your account and you'd rather it wasn't shown, choose Hide my receiptat the bottom of your receipt page and sign in with GitHub to confirm it's you. Claimed builders can also do this in Settings. When you hide it:

• we stop printing receipts for your account, including if you rename it;
• we delete the receipts we stored, and keep only your GitHub username and account ID so it stays hidden;
• if you didn't already have a StackStory account, the account created by that sign-in is deleted right away;
• share images stop loading from our servers within a day. We can't remove copies other sites already made.

Claiming your receipt later shows it again.

2. Builders who claim a receipt

• GitHub sign-in.GitHub shares your account ID, username, name, avatar and email address with us. We don't ask for access to private repositories, and the sign-in can't change anything on GitHub. We keep the sign-in token to look up your account and repositories when we check your products.
• Profile basics. We copy your name, avatar, bio, location and links from your GitHub profile.
• Proofs. For each live product on your receipt: your share of the commits in its repository, whether its website responds, a DNS record or meta tag you add to prove the domain, and a confirmation from your client (see below).
• Settings and activity. Your leaderboard choice and country, email preferences, whether your receipt is shown, and when you last opened the dashboard.

3. Clients asked to confirm a project

When a builder asks a client to confirm a project, the builder gives us the client's name, email address and, optionally, company. We send that client one email with a link to confirm or decline, with an optional short quote. We keep the client's name, company, email domain (for example acme.com) and their answer. We don't store the client's full email address. Nothing is shown unless the client confirms, and the link works only once.

4. Visitors

• We use IP addresses briefly to limit abuse, such as printing too many receipts. These counters are deleted every night.
• We count views and shares of each receipt. These are totals, not records of who viewed it.

5. Email

We send email for sign-in, client confirmations and, for builders who claimed a receipt, a weekly receipt. Every weekly email has a one-click unsubscribe link, and you can turn it off in Settings.

6. No AI

Receipts and proofs are counted from data, never written by AI, and we don't send your data to AI providers.

7. What's public

Receipts (unless hidden) with the proofs on their products, and the leaderboard, which only lists builders who opted in. Settings and client email addresses are private.

8. Service providers

We use these providers to run StackStory. Each receives only what its job needs:

• Supabase: database and sign-in.
• Vercel: hosting. It sees IP addresses in order to serve pages.
• GitHub: the source of receipt data, and sign-in.
• Resend: email delivery.

We don't sell personal data, and we don't use advertising or tracking cookies.

9. Cookies

We only use the cookies needed to keep you signed in.

10. How long we keep data

• Your account: until you delete it in Settings. Deleting your account removes your claim, proofs and stored GitHub token. Receipts can still be printed from public GitHub data afterwards unless you hide yours, so hide it first if you want it gone too.
• Receipt snapshots: until the account's owner hides the receipt.
• Abuse-prevention counters: deleted nightly.

11. Your rights

You can ask for a copy of your data, a correction or deletion, or object to how we use it. The quickest way to stop us processing your public GitHub data is to hide your receipt (section 1). For anything else, email hello@stackstory.devand we'll reply within 30 days.

12. Children

StackStory isn't meant for anyone under 16.

13. Changes

We'll update the date at the top of this page when this policy changes, and tell builders who claimed a receipt about material changes by email.

14. Contact

Questions about your data? Email hello@stackstory.dev. See also our Terms of Service.