Privacy Policy

Data Privacy Declaration

The data controller in accordance with GDPR and other data protection laws is: Newmatik GmbH, Dominik Ottenbreit, Am Markt 1, 55619 Hennweiler, Germany

This policy covers the website gitscore.dev and the GitScore service, which Newmatik GmbH operates. The imprint lists our full company details.

The Short Version

GitScore ranks GitHub activity across repositories you choose. To do that it needs your GitHub sign-in and read access to those repositories. We only collect the minimum amount of personal information that is necessary to provide the service; we don't sell it to third parties; we don't use analytics or advertising trackers; and we only use your data as this Privacy Statement describes. We take protecting your data seriously.

Your Rights Under GDPR

As we operate under European data protection law (GDPR), you have several important rights that we want you to know about. You have the right to:

• Access your personal data that we process
• Correct any inaccurate data we might have about you
• Request erasure of your personal data ("right to be forgotten")
• Restrict how we process your data
• Take your data with you to another service (data portability)
• Object to how we process your data
• Withdraw your consent at any time
• Lodge a complaint with your local data protection authority

If you'd like to exercise any of these rights, just email us at service@newmatik.com. We're here to help!

These rights also apply if you never signed in to GitScore but contributed to a repository that a GitScore user scanned (see "Scans and contribution data" below).

What Information We Collect and Why?

Visiting the Website

GitScore runs on Cloudflare Workers. When you open gitscore.dev, Cloudflare processes your IP address and the request data your browser sends (requested page, date and time, browser type, language preference, referring site) to deliver the page and to protect the service against abuse. Cloudflare Workers logs keep request metadata and the application's own log messages (for example a scan ID, a repository name and error messages) so that we can investigate errors.

Signing In with GitHub

You sign in with your GitHub account. Sign-in runs through Supabase Auth, which redirects you to GitHub. GitScore asks GitHub for these permissions (OAuth scopes):

• read:user: your public GitHub profile
• user:email: your email address (Supabase Auth always requests it)
• read:org: the organisations you belong to
• repo: access to your repositories, including private ones. GitHub offers no read-only scope for private repositories; GitScore only reads from them and never writes to GitHub.

From your GitHub account Supabase Auth stores your user account: GitHub user ID, username, display name, email address and avatar URL, together with the sign-in timestamps. GitScore copies your GitHub user ID, username, display name and avatar URL into its profile table.

Your GitHub Access Token

All GitHub requests are made by our server; your browser never receives the GitHub token. We store the token in our database so that scans keep working after your browser session refreshes:

• one copy linked to your account, encrypted with AES-256-GCM. It is deleted when you log out of GitScore.
• one encrypted copy for each running scan, which the background worker uses. It is deleted as soon as the scan has finished or failed.

You can also revoke GitScore's access at any time in your GitHub settings under Applications.

Organisations and Repositories

To show the organisations and repositories you can pick from, GitScore stores a list of them for your account (organisation login and avatar URL; repository name, owner, and whether it is private or archived). The list is refreshed from GitHub when you load it again.

Scans and Contribution Data

When you start a scan, GitScore stores the scan itself (selected organisation or repositories, date range, status, progress and any warnings) and reads the following activity of the selected repositories from GitHub: commits, issues, pull requests, reviews, issue and review comments, and thumbs-up reactions on comments.

GitScore stores this activity only as daily counts per contributor and repository: the contributor's GitHub username, the day, and the number of commits, opened and closed issues, opened and merged pull requests, reviews, comments, thumbs-up reactions, and added and deleted lines, plus whether the account looks like a bot. It does not store commit messages, issue or comment text or source code.

This means a scan also processes data about other people: everyone who contributed to the scanned repositories in the selected period, whether or not they use GitScore. Only the user who ran a scan can see its results. When you open a contributor's detail page, GitScore loads their public GitHub profile (name, avatar, bio, company, location, website, number of public repositories and followers) live from GitHub and does not store it.

Your Settings

GitScore stores your settings for your account: whether to hide contributors without activity, your default language, your scoring weights and time model, and the GitHub usernames you mark as bots.

Error Monitoring with Sentry

We use Sentry to detect and fix errors in the browser and on the server. When an error occurs, Sentry receives the error message and stack trace, the page address without query parameters, your browser's User-Agent (browser and operating system) and Referer headers, and for errors during a scan the scan ID and the repository name. We also send performance traces for a sample of 20% of requests. We have switched off the collection of user details, cookies, other request headers, request and response bodies, query parameters, database queries and local variables. Sentry does not record your sessions (no session replay). Our Sentry project stores its data in Sentry's EU region (Germany).

Contacting Us

When you reach out to us by email, we store the information you provide to handle your request and any follow-up questions. This typically includes your name, email address, and the content of your message.

If we receive an email from you, we assume we can respond via email too. If you prefer a different communication method, just let us know!

Legal Basis

We process your account, token, repository, scan and settings data to provide GitScore to you (Article 6(1)(b) GDPR). We process request data, logs and error reports based on our legitimate interest in running a secure and working service (Article 6(1)(f) GDPR).

Our Use of Cookies

GitScore uses only cookies that it needs to work. It does not use analytics, advertising or tracking cookies, so it does not ask for consent.

Managing Cookies

You can prevent cookies by adjusting your browser settings (look in your browser's Help section to find out how). Without the sign-in cookies you cannot log in to GitScore.

Analytics

GitScore does not use any web analytics.

Service Providers and Where Your Data Is Processed

Your GitHub data comes from GitHub, which you use under GitHub's own terms and privacy statement.

International Data Transfers

Sometimes we need to transfer your data outside the European Economic Area (EEA). When we do, we make sure it's protected using approved methods like standard contractual clauses or adequacy decisions.

Data Security

We take security seriously. We use encryption for data in transit, regularly assess our security, control who has access to data, and train our staff in data protection. GitHub tokens are stored encrypted, and database access is restricted so that each user can only read their own data.

Updates to This Policy

We review this privacy policy regularly and will post any updates here. This policy was last updated on October 14th 2026.

Need More Information?

If you have any questions about our privacy practices, we're happy to help! Just email us at service@newmatik.com or write to us at: Newmatik GmbH, Am Markt 1, 55619 Hennweiler, Germany.