Privacy

Who is responsible

The controller is Jesús Lagares, who runs auracheck.dev as an individual from Spain (details in the legal notice). Write to legal@auracheck.dev for anything about your data.

What we process and why

• Your account (name, email, avatar, and a password hash if you sign up with email; your GitHub or Google account id if you sign in with them), and your session: to give you an account. Basis: contract.
• Your public GitHub profile (username, name, bio, avatar, location, website, followers, public repositories and their stars) and the public download numbers of your packages, with a daily snapshot to show history: this is the profile you asked for. Basis: contract.
• Registry accounts you link: the username, and how it was verified. To verify it we read the email the registry publishes for it, or send a one-time code to that email; the email itself is not stored. Basis: contract, and our legitimate interest in stopping people from claiming others’ work.
• Your itch.io API key, if you add it: stored encrypted and used only to read your games’ download counts. Basis: contract.
• Your place on the leaderboard: you can opt out in settings. Basis: contract.
• The requests you post on the roadmap and your votes: a request is public with your auracheck.dev handle; votes only show as a total. They are deleted with your account. Basis: contract.
• If you advertise: your product's name, tagline, link and logo (public on the ad), what you pay, your invoices and a contact email to manage the slot. Your payment card is kept by Stripe; we only see its brand and last four digits. Basis: contract.
• Anonymous usage statistics (pages viewed, buttons used) with PostHog in cookieless mode: no cookies, no personal profiles, a daily-rotating hash instead of your IP. Basis: legitimate interest in improving the service.
• Technical logs (requests, errors) to keep the service working and secure. Basis: legitimate interest.

People who haven’t signed up

If someone visits auracheck.dev/username for a person who isn’t registered, we show an invitation page with that person’s public GitHub name and avatar, fetched from GitHub and cached for up to a day. Nothing is stored and no numbers are shown. If that’s you and you’d rather not have the page, write to legal@auracheck.dev and we’ll block it.

Who processes data for us

Transfers to the United States rely on the EU-US Data Privacy Framework or, where it doesn’t apply, on Standard Contractual Clauses. We don’t sell or rent data to anyone.

• Vercel (hosting; United States): EU-US Data Privacy Framework.
• Supabase (database, hosted in the EU, Ireland): Standard Contractual Clauses.
• PostHog (analytics, EU cloud).
• GitHub (sign-in, public data, and the daily refresh job; United States): EU-US Data Privacy Framework.
• Google (sign-in; United States): EU-US Data Privacy Framework.
• Stripe (advertisers' payments and invoices; Stripe Payments Europe, Ireland, with transfers to the United States under the EU-US Data Privacy Framework).
• Resend (account and notification emails; sent from the EU, Ireland, with records kept in the United States): EU-US Data Privacy Framework or Standard Contractual Clauses.
• An email provider for sign-in and verification emails, once we have one.
• To build profiles we also query, with public usernames only, npm, PyPI and pypistats.org, ecosyste.ms, the Visual Studio Marketplace, Open VSX and itch.io.

How long we keep it

Everything about your account stays until you delete it. Deleting it from settings removes your account, profile, history, linked accounts and keys at once; only data the law requires us to keep blocked, if any, is kept for that purpose. Invitation pages are cached for at most a day. Technical logs are kept for a short time by our providers.

Profiles, README cards and share images are public: search engines and social networks may keep their own copies for a while after you delete your account.

Your rights

You can access, correct, delete or take a copy of your data, object to or restrict its processing, and withdraw any consent, by writing to legal@auracheck.dev; we answer within a month. Downloading a copy of your data (a JSON file), deleting your account and leaving the leaderboard are also in your settings.

If you think we handled your data wrongly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Age

You must be at least 14 (or the age set by the law in force in Spain) to create an account.

Security

Passwords are hashed, API keys are encrypted at rest, the database isn’t reachable from the public internet, and connections are encrypted. If a breach put your data at risk, we would tell you and the AEPD as the law requires.

Changes

If this policy changes in a way that matters, we’ll say so on the site before it applies.