Privacy Policy

Last updated: March 2026

Who we are

GitWorld is operated by timhasideas as a solo indie project. The service is available at www.gitworld.live. For any privacy questions contact privacy@gitworld.live.

What we collect and why

When you sign in with GitHub we receive and store:

Your GitHub user ID, username, and avatar URL — to identify your account and display your character in the world
A GitHub OAuth access token — to read your repositories and commit history on your behalf. This token is stored in your encrypted session cookie and is never written to our database.
Your repository names, commit counts, and activity timestamps — to calculate your brick counts and tower state. We do not read commit messages or file contents beyond what is needed for quality filtering.

We do not collect your email address, real name, location, or any other GitHub profile data beyond the above.

How we use your data

To render your towers and progress in the GitWorld map
To send inactivity warnings when your towers are leaning (if you opt in to notifications)
To display your public profile at gitworld.live/u/username
To calculate leaderboard rankings

We do not sell your data, share it with advertisers, or use it for any purpose beyond operating GitWorld.

Public profile

Your username, avatar, total brick count, and repository names are visible on your public profile page at gitworld.live/u/[username]. If you delete your account this page is removed.

Cookies and storage

We use one session cookie to keep you signed in. This cookie is encrypted and contains only your session token — it does not contain tracking data.

We use your browser's localStorage to cache your repository data so the map loads instantly if our servers are temporarily unreachable. This data never leaves your device.

We do not use advertising cookies or third-party tracking cookies.

Third-party services

GitHub — OAuth authentication and repository data. Governed by GitHub's Privacy Policy.
Supabase — database hosting. Data is stored in EU data centres. Governed by Supabase's Privacy Policy.
Vercel — web hosting. Governed by Vercel's Privacy Policy.
Stripe — payment processing if you purchase cosmetics. We never see or store your card details. Governed by Stripe's Privacy Policy.

Data retention

Your account data is retained for as long as your account is active. If you request deletion we will remove your user row, all associated repository data, and all owned items within 30 days. To request deletion email privacy@gitworld.live with subject "Delete my account".

Your rights (UK/EU)

Under UK GDPR and the Data Protection Act 2018 you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Object to processing of your data
Data portability — receive your data in a machine-readable format

To exercise any of these rights email privacy@gitworld.live. We will respond within 30 days.

Children

GitWorld requires users to confirm they are 13 years of age or older before entering. We do not knowingly collect data from children under 13. If you believe a child has signed up please contact us immediately.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced on our X account @gitworld. The date at the top of this page always reflects the latest revision.

GitWorld · Back to the world