Privacy policy

Last updated: October 2026

1. Who is responsible

Controller within the meaning of the General Data Protection Regulation (GDPR):
Marco Pollmann, Schwalenbergstr. 7, 33428 Marienfeld, Germany
Email: info@twoclouds.de

2. Overview

Shipgrit is a leaderboard of developers based on their GitHub activity. Only people who sign in with GitHub appear on Shipgrit. We never have access to your code. Below we explain which data we process, why, and what rights you have.

3. Visiting the website

When you open Shipgrit, our hosting provider automatically processes technical data that your browser sends: IP address, date and time, the page requested, browser type and operating system. This is necessary to deliver the website and to keep it secure (Art. 6 (1) (f) GDPR – our legitimate interest in a working, secure website). These server logs are kept by the hosting provider for a short time only and are not combined with other data.

Fonts are served from our own server; no connection to Google or other font providers is made.

4. Signing in with GitHub

You sign in through GitHub (GitHub, Inc., USA). We only request the read:user permission, which gives us your public profile data – no access to repositories or code. After signing in, we store:

  • your GitHub ID, username, name, profile picture, bio and location
  • your X account and website, if shown on your GitHub profile

We then regularly retrieve your publicly available GitHub data: your public repositories (name, description, languages, stars, last activity), your public activity (pushes, pull requests, issues, releases) and the daily contribution counts of your GitHub contribution graph – the same numbers GitHub shows on your profile. From this we calculate your rank.

Legal basis: Art. 6 (1) (b) GDPR – providing the service you signed up for (your profile and ranking).

5. Private repositories (optional)

If you install our GitHub App, it receives read-only access to the metadata of the repositories you choose: repository names, languages, activity dates and events. The app has no access to code or file contents. Private repositories are always shown as anonymous “stealth projects”: other visitors only see the tech stack and when you were last active – never the name, description or links. Their activity counts toward your rank.

Legal basis: Art. 6 (1) (a) GDPR – your consent by installing the app. You can withdraw it at any time by uninstalling the app or removing repositories in your GitHub settings; the data is then removed with the next update.

6. Information you enter yourself

In your settings you can add a status, X account, website, links and a tech stack for each project, choose which projects are public, stealth or hidden, and upload your own profile picture. This information is shown on your public profile and on the leaderboard. Legal basis: Art. 6 (1) (b) GDPR.

7. What is public

Your profile, rank, activity graph, public projects and the information you entered are visible to everyone. Stealth projects are shown without name, description and links. Hidden projects are not shown and do not count.

8. Cookies and local storage

  • Login cookie: after signing in we set an encrypted session cookie so you stay signed in. It is technically necessary (§ 25 (2) TDDDG) and is deleted when you sign out or it expires.
  • Dark mode: if you switch between light and dark mode, your choice is saved in your browser's local storage. It never leaves your device.

We do not use tracking, analytics or advertising cookies.

9. Service providers

We use the following providers, who process data on our behalf (Art. 28 GDPR):

  • Vercel Inc. (USA) – hosting of the website
  • Supabase Inc. – database and storage of profile pictures; the data is stored on servers in the European Union
  • GitHub, Inc. (USA) – sign-in and source of the GitHub data described above

Vercel, GitHub and Supabase are US companies, so data may be transferred to the USA. These providers are certified under the EU-US Data Privacy Framework, or the transfer is covered by EU standard contractual clauses (Art. 45 and 46 GDPR).

10. Sponsors

Sponsor slots are links to external websites. We do not pass on any data to sponsors. If you contact us about a sponsorship by email, we use your message only to answer it (Art. 6 (1) (b) and (f) GDPR).

11. How long we keep data

  • Profile and settings: until you delete your account
  • Activity data: up to about 13 months; older entries are deleted automatically
  • Uploaded profile pictures: until you replace them, switch back to your GitHub picture or delete your account

12. Your rights

You have the right to:

  • access the data we store about you (Art. 15 GDPR)
  • have it corrected (Art. 16) or deleted (Art. 17)
  • restrict its processing (Art. 18) and receive it in a portable format (Art. 20)
  • object to processing based on legitimate interests (Art. 21)
  • withdraw consent at any time with effect for the future (Art. 7 (3))

You can delete your account yourself at any time at the bottom of your settings – this removes your profile, projects, activity data and uploaded picture immediately. To exercise any other right, email info@twoclouds.de. You can also revoke Shipgrit's access at any time in your GitHub settings under “Applications”.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

13. Changes

We update this privacy policy when the website or the legal situation changes. The current version is always available on this page. See also our imprint.