This notice explains what personal data allreposhere.com (“All Repos Here”, “we”, “us”) handles, why, and what you can do about it. It takes effect on the “Last updated” date above.
The short version
- The site is run by an individual based in Mumbai, India.
- There are no accounts, no logins and no ads. We do not sell personal information or share it for advertising.
- Your favourites are stored only in your own browser. They are never sent to us.
- We count clicks on GitHub links per repository per day. The counts hold no IP address, cookie or other identifier.
- If you use the contact form, we store what you send so we can read and answer it.
- Website analytics are optional.
Who is responsible for your data
All Repos Here is operated by an individual based in Mumbai, India, who is the controller (in Indian law, the data fiduciary) for the personal data described here.
For questions about your data, requests and grievances, email [email protected]. For anything else, use the contact form.
What we collect and why
Browsing the site
Favourites. When you save a repository as a favourite, the list is kept in your browser’s local storage under the name arh:favs. It never leaves your device, so we cannot see it.
Click counts. When you open a repository’s GitHub page from the site, your browser tells our server which repository you clicked. The server adds one to that repository’s total for the day. The stored count contains only the repository, the date and a number.
Click abuse checks. To stop one visitor inflating the counts, the server uses two short-lived checks based on your network address (your IPv4 address, or the first half of your IPv6 address):
- A rate limit kept only in the server’s working memory. It uses a hashed (one-way scrambled) version of your network address, combined with a random value, and it is never written to a database.
- A record that you have already clicked a given repository in the current hour. It is a hashed version of the hour, your network address and the repository, stored in our database until the end of that hour and then deleted automatically.
Because these hashes come from your IP address, we treat them as personal data. They are pseudonymous, which means they do not show your IP address directly but could be linked back to it.
Hosting. The site runs on Cloudflare. Like any web host, Cloudflare processes technical data about each request, such as your IP address, browser type, the page requested and the time, to deliver pages and block attacks. Cloudflare may keep this in short-lived logs under its own retention settings.
Using the contact form
The form asks for your name, email address, the reason for your message, the message itself and, optionally, a GitHub repository link. We also record the page you sent it from and when it arrived.
This is stored in a database hosted by Cloudflare, and a notification email with the same details is sent through Cloudflare Email Routing (or Resend, if Email Routing is unavailable) to the operator’s email inbox, which is hosted by Google. We use it only to read and respond to your message and to act on what you ask, such as reviewing a suggested repository. We do not add you to a mailing list.
We do not store your IP address, browser details or any cookie with your message.
Bot protection. The form uses Cloudflare Turnstile, which checks signals from your browser, such as your IP address and browser details, to tell people from bots. To confirm the result, our server sends Cloudflare the Turnstile token and your IP address. Cloudflare explains its handling in its Turnstile privacy addendum.
Rate limit. To limit repeated sending, our database keeps a hashed version of your IP address, combined with the time window, and a counter for a 10-minute window. Like the click hashes, this is pseudonymous personal data.
Website analytics
If you accept analytics cookies, we use Google Analytics to see which pages people visit and how they find the site. You can change your choice in Cookie settings. How Google uses this data.
Information about projects
Repository details, such as stars, licences and release dates, come from public GitHub data, and headlines come from Hacker News and dev.to. Our server fetches this public information. Your browser contacts those sites only when you follow a link to them.
Legal bases (where UK or EU law applies)
| Data | Purpose | Legal basis |
|---|---|---|
| Contact form details | Reading and answering your message | Legitimate interests in responding to people who write to us, or steps you ask us to take |
| Hashed network addresses and Turnstile signals | Preventing spam and abuse | Legitimate interests in security |
| Hosting data processed by Cloudflare | Delivering the site and blocking attacks | Legitimate interests in running a working, protected website |
Daily click counts contain no personal data. Favourites never leave your device.
How long data is kept
| Data | How long |
|---|---|
| Contact messages in our database | Deleted automatically 24 months after the last activity on them, such as a status change or note |
| Notification emails | Copies may remain in the operator’s email inbox. They are not deleted automatically |
| Contact form rate-limit hash | Used for a 10-minute window, then deleted automatically, usually soon after the window ends and at the latest about a day later |
| Click record for the current hour | Deleted automatically after the hour ends |
| Click rate limit in memory | Never written to storage. Lost when the server’s memory is cleared |
| Daily click counts | Kept as long as they are useful. They contain no personal data |
| Cloudflare hosting logs | Set by Cloudflare’s own retention |
| Google Analytics data (only if you opt in) | Set by the retention setting in our Google Analytics account |
Who receives data
- Cloudflare, Inc. hosts the site, the database and the servers, forwards notification emails and runs Turnstile.
- Resend may deliver notification emails if Cloudflare Email Routing is unavailable.
- Google LLC hosts the operator’s email inbox and, only if you opt in, provides Google Analytics.
We may also disclose data where the law requires it.
International transfers
The site is run from India. Our providers process data in the United States and other countries where they operate.
Your rights and grievances
You can ask to see, correct, update or delete the personal data we hold about you, object to how we use it, withdraw consent where we rely on it, or raise a grievance. In India you can also nominate someone to exercise your rights if you die or become unable to. In practice, the only personal data we are likely to hold about you is a contact message.
Email [email protected], ideally from the address you used, or give enough detail to find your message. We may ask for information to confirm your identity. We respond within the period required by applicable law. India’s Digital Personal Data Protection Rules, 2025 set that period at no more than 90 days.
You can also complain to the Data Protection Board of India or, if you are in the EU or UK, to your data protection authority.
Do Not Track and tracking by others
Browsers’ Do Not Track signals have no common standard, so the site does not change its behaviour when it receives one. The site uses no advertising trackers. No third party tracks you across other sites through this site, except that Cloudflare uses Turnstile signals to improve its bot detection.
Children
The site is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, email [email protected] so it can be deleted.
Security
Contact messages can be viewed only through an admin area protected by Cloudflare Access, which only the operator can sign in to. Collecting little is our main safeguard. No system is perfectly protected, so please do not send sensitive information through the contact form. If a security breach affects your personal data, we notify you as the law requires.
Changes to this notice
This notice is dated. When it changes, the “Last updated” date at the top changes, and the new version applies from that date.