Privacy Policy

1. Introduction

GitHub HR ("we," "us," or "our") operates a SaaS platform that helps recruiters find and evaluate software developers using publicly available GitHub data. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

This policy applies to all users of our platform, including recruiters who create accounts and developers whose public GitHub profiles are indexed by our service.

2. Data We Collect

Developer Data (from Public GitHub)

We collect publicly available information from GitHub profiles through GitHub's official API. This includes:

• Username, display name, bio, location, company, personal website and public social handles
• Public repository names, descriptions, primary languages and language byte counts
• Contribution activity (commit counts, pull requests, reviews, recent push dates)
• Follower and following counts, and the "available for hire" flag if set
• Public email address (only if the developer has made it public on GitHub)
• Excerpts of public source code, and public commit metadata — to assess code quality we retain samples of file contents, README files, dependency manifests, directory listings, and commit messages with their dates and identifiers, all from public repositories.
• Profile picture, organisation memberships, account creation date, and GitHub programme badges
• Aggregate counters GitHub exposes about activity in repositories we cannot see (a total count of restricted contributions). This is a number only — no private repository content, names or metadata.
• Assessments we generate — an AI-produced written summary, numeric scores, and a vector embedding derived from the material above. These are our own inferences about the developer, not data GitHub provided.
• Recruiter activity about a developer — whether a recruiter saved, contacted, shortlisted or rejected the profile, any free-text note they wrote, and aggregate view and save counts.

We do not access private repositories, private profile information, or any data requiring GitHub authentication on behalf of indexed developers. All developer data is sourced exclusively from publicly available GitHub API endpoints.

Recruiter Account Data

When you create an account, we collect the information you provide through our authentication provider Clerk, including:

• Email address
• Full name
• Company name (if provided)
• Authentication credentials (managed securely by Clerk)

Payment Data

Payment processing is handled by Clerk Billing, which uses Stripe as its payment processor. We do not store credit card numbers, bank account details, or other sensitive payment information on our servers. We receive only limited transaction data (plan type, subscription status, billing dates) necessary to manage your account.

3. How We Use Data

We use the data we collect for the following purposes:

• AI-Powered Scoring: We analyze public GitHub activity using artificial intelligence to generate code quality scores across multiple dimensions (code quality, activity level, project diversity, documentation, community engagement, and technical breadth).
• Candidate Matching: We match developer profiles against job descriptions or search criteria provided by recruiters.
• Ranked Leaderboards: We present scored and ranked developer profiles to recruiters through our dashboard.
• Account Management: We use recruiter data to manage accounts, process subscriptions, and provide customer support.

4. Data Storage & Security

Your data is stored and processed using the following infrastructure providers:

• Convex (Convex, Inc., a United States company; our deployment runs in the EU West 1 region) — Primary database for developer profiles, task data, and application state
• Clerk (managed service) — Authentication and user account management
• Clerk Billing / Stripe (managed services) — Payment processing and subscription management
• Vercel (global CDN) — Application hosting and delivery
• Anthropic (United States) — The AI models that assess public code and interpret job descriptions. Public repository excerpts and recruiter search text are sent for processing.
• Voyage AI (United States) — Generates the numeric embeddings used for similarity search. Receives username, name, location, bio, repository names and the generated summary.

All data is transmitted over encrypted connections (TLS/HTTPS). We rely on the security practices of our infrastructure providers, all of which maintain industry-standard security certifications.

5. Data Retention

• Developer profiles are retained until a deletion request is received from the developer. Profiles may be refreshed periodically with updated public GitHub data.
• Recruiter accounts are retained for the duration of the active subscription and in accordance with Clerk's data retention policies.
• Payment records are retained as required by applicable tax and accounting regulations, managed by Stripe.
• Pipeline logs (internal processing records) are retained for as long as the deployment keeps them. We do not currently operate an automated deletion schedule for them, so we do not claim a fixed retention period. They contain task identifiers, phase names, diagnostic messages and — when processing a specific profile fails — the GitHub username it failed on.

6. Third-Party Sharing

We do not sell, rent, or share personal data with third parties for marketing purposes. Data is shared only with the infrastructure and AI providers listed in section 4 (Convex, Clerk, Clerk Billing/Stripe, Vercel, Anthropic, Voyage AI) as necessary to operate the service. These providers act as data processors on our behalf and are contractually obligated to protect your data.

7. Your Rights

You have the right to:

• Access — Request a copy of the data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your data from our systems
• Portability — Request your data in a machine-readable format
• Objection — Object to the processing of your data

Developers: If your public GitHub profile has been indexed by our service and you would like it removed, please contact us at the email below. We will process removal requests within 30 days.

Recruiters: You can manage your account data through your dashboard settings. For account deletion, contact us at the email below.

8. Contact

For any privacy-related requests or questions, contact us at: email.vlad.vrinceanu@gmail.com

9. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes we update the "Last updated" date at the top of this page. We do not currently operate an individual notification channel, so we do not promise email or in-app notice; the date above is the record. Continued use of the service after changes constitutes acceptance of the updated policy.