Privacy policy
Last updated: 21 October 2026.
maintainers.dev is an inbox for people who maintain open source. It reads your notifications and the public activity of the projects you follow, and keeps them on your device so you can work offline. This policy explains what we collect, why, who else handles it, how long we keep it, and what you can do about it.
Who we are
maintainers.dev is run by The Poetry Company Limited, Fernwood House, Fernwood Road, Jesmond, Newcastle upon Tyne, NE2 1TJ, United Kingdom. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018.
Contact: contact@poetry.sh. ICO number ZB116792.
The short version
- You sign in with GitHub, an atmosphere account (Bluesky or another PDS), Codeberg or GitLab. We keep the sign-in tokens encrypted.
- We store your notifications, your triage choices and your settings so the app works across devices and offline.
- We store public issues, pull requests and comments from repos you follow. That includes what other people wrote in public.
- We send public issue and comment text to an AI model to suggest what might need your attention. We do not interact with a forge on your behalf unless you initiate it.
- We use privacy-friendly analytics. We don't use advertising or tracking cookies, and we don't sell data.
- You can download your data and delete your account yourself, in Settings › Account, or on the waitlist page while you wait.
What we collect and why
When you sign in
| What | Why | Legal basis |
|---|---|---|
| Your forge or atmosphere account: user id or DID, login or handle, avatar URL | to create your account and sign you in | contract |
| Access tokens from the forge, and refresh tokens where the forge issues them | to read and act on the forge as you, when you ask | contract |
| Your email address from GitHub (your primary verified address), or from Codeberg or GitLab if your profile shows one. Atmosphere sign-in gives us no email | to tell you when you're off the waitlist | steps you ask for before using the service (contract) |
| A session: when it started, when it was last used, and your browser's user agent | to keep you signed in | contract; legitimate interests (security) |
| The forge you last signed in with, in your browser's local storage | to show that sign-in button first next time | legitimate interests |
We encrypt every token with AES-256-GCM before we store it. We don't store your IP address. Our host (Vercel) sees it with every request, as any host does.
The atmosphere sign-in session is revoked as soon as you're signed in, so we keep nothing from it. If you link Tangled for writing, we keep that session (encrypted) so we can write the Tangled records you choose.
While you're on the waitlist
| What | Why | Legal basis |
|---|---|---|
| Your account and email as above, and an email address you give us on the waitlist page | to tell you when you're in | contract |
| Your public GitHub follower and repo counts, read when an admin opens the waitlist | to decide whom to admit first | legitimate interests (fair, manageable admission) |
| Invite codes, stored only as a hash | to admit people invited by others | contract |
Until you're admitted, we don't read your notifications, ingest your repos, or run any AI on anything for you, and we keep no token from your sign-in: only your account and email. When you're admitted, we sign you out, and your next sign-in gives us the tokens.
We tell you you're in by email, sent by hand from daniel@roe.dev. We don't send newsletters or marketing.
When you use the app
| What | Why | Legal basis |
|---|---|---|
| Your notifications from GitHub, Codeberg and GitLab: repo, title, link, reason, read and done state | to show your inbox | contract |
| For notifications from private GitHub repos, only that one exists: no title, repo or link | to count them without storing private content | contract |
| Your triage choices: done, snoozed, muted, waiting, and why something was resolved | to keep your inbox in step on every device | contract |
| Your settings, tiers for each repo and owner, lists and notes, focus sets, saved views, pinned people, dismissed and corrected suggestions | so the app works the way you set it up | contract |
| Your activity on GitHub from the last 90 days (searches for what you authored, reviewed, were assigned or commented on), your open pull requests and issues in other people's repos, and the dependencies of your packages | to suggest tiers, track your contributions and show your upstream projects | contract |
| A log of what you ask the app to do on a forge, including the text of comments you send (the text for 7 days) | so a write is sent once, can be retried, and can be audited | contract; legitimate interests (preventing duplicate or lost writes) |
| A log of each notifications poll: counts, rate limit and errors | to keep polling within the forge's limits and measure cost | legitimate interests |
| A private log of accounts you ban: who, where, your reason and note | so you can review and undo bans | contract |
If you turn on notification sync, GitHub gives us a second token, limited to the notifications scope (and public_repo if you allow public writes). We use it, on your own GitHub rate limit, to read: your notifications; repos you follow that don't have the App; the activity signals that suggest how closely to follow each repo; your open pull requests and issues in other people's repos; upstream threads that mention your packages; the public events of people you pin; and which release shipped a merged pull request, in repos without the App. Settings lists the same.
If you administer a repo: security data
If your token authenticates you to GitHub as an admin of a public repo the app reads, we show you that repo's security advisories, Dependabot, code scanning and secret scanning alerts, and security settings. Only confirmed admins see them. We check again every day, and when a GitHub webhook reports a membership change. If the check fails or GitHub no longer reports you as an admin, we delete your copy (after at most 24 hours if GitHub is down). We never read or store the secret in a secret scanning alert, never send advisory text to any AI model, and never log it.
Data about people who don't use maintainers.dev
Open-source work happens in public. To show maintainers their projects, we store public data from public repos whose owner has installed our GitHub App (or connected a Codeberg or GitLab webhook), or that an admitted user follows. This includes, for anyone who takes part:
- your forge login, display name and avatar;
- issues, pull requests, comments, reviews, reactions and labels you added, with their dates;
- public profile details and public events on GitHub, used to estimate whether an account is automated;
- your public activity, if a user pins you as a maintainer they follow;
- your npm username, if you maintain a package a user depends on (we don't keep npm email addresses).
We do this on the basis of legitimate interests: maintainers need to keep up with public conversations in their own projects, and this data is already public. We limit it to public repos. We delete a repo's data when it becomes private, is deleted, or leaves the App install. We never store confidential GitLab issues or internal notes.
The automation estimate is an indicator. It can label an account as possibly automated and change how its posts are ranked, but it never blocks, hides or reports anyone on its own.
If a maintainer bans you, their private ban log records your login, where you were banned, and their reason and note. Only that maintainer can see it.
Anyone can read the public data we store for an owner through the app's public sync endpoint, as they can on the forge itself. Nothing from users' accounts is in it.
You have the same rights as users over this data (see Your rights). When something is deleted on the forge and we receive the change, we delete it too.
AI suggestions
We use AI models to read public text and suggest things: whether a comment asks for something, whether an issue needs a reproduction, which labels fit, which issues look like duplicates, and which comments say thanks.
- What we send: the title and body of public issues and pull requests, and the text of public comments and reviews, with the thread's title and state. To suggest labels, we also send the repo's name, its label names and descriptions, and titles of example issues. To find duplicates, we send an issue's title and opening post (up to 8,000 characters).
- What we never send: your email, tokens, settings, notes, lists, notifications, corrections or dismissals; anything from a private repo; security advisories and alerts.
- Who receives it: models from Perplexity, reached through Vercel AI Gateway. Vercel AI Gateway excludes this text from model training, but does not offer zero data retention, so the provider may keep it for a time under its own terms.
- What we keep: the model's answer, its confidence and a short reason, linked to the comment. We delete the text we queued once it has been read. Embeddings (number vectors used to find duplicates) stay on our server and are deleted with the issue.
AI output is only ever a suggestion. It can sort and refine what you see, but nothing is hidden from you without a way to see it, and nothing is written to a forge on the basis of AI output unless you choose it. We make no decisions about you by automated means that have legal or similarly significant effects.
Translation of comments happens on your device, with your browser's built-in translator. We don't send text anywhere to translate it.
What happens on forges in your name
We only post, label, merge, close, review, react, ban or change settings on a forge when you choose to, one item at a time or as a batch you have reviewed. Two kinds of change are synced without a click, because they're private to you:
- marking GitHub notifications read or done when you do so in the app, and when the app resolves a notification that a later maintainer action already handled (you can turn this off in Settings);
- your GitHub watch settings, if you turn on watch sync (off by default).
Who else handles your data
We use these providers to run the service. They process data on our behalf, under contract.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | hosting, content delivery, server logs, AI Gateway, and page-view analytics | United States (iad1) |
| Neon (Databricks Inc.) | database | United States (us-east-1) |
| Fly.io, Inc. | runs the sync service (Electric), which holds copies of the rows sent to your browser | United States (iad) |
| Perplexity AI, Inc., through Vercel AI Gateway | AI models | United States |
These services are separate controllers with their own privacy policies. We exchange data with them because you asked us to:
- GitHub, Codeberg and GitLab: we call their APIs with your tokens and our App's tokens. Your browser also loads avatars from GitHub and reads some public data from the forges directly.
- Your atmosphere PDS, the PLC directory, Bluesky's public API and Tangled: for atmosphere sign-in, the handle suggestions as you type (sent from your browser to
public.api.bsky.app), and Tangled data. - npm and ecosyste.ms: we read public package data. We send them no data about you.
We don't sell or rent personal data, and we don't share it for advertising.
International transfers
We're in the UK. Our providers store and process data in the United States. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK's adequacy regulations for it. Otherwise we rely on the UK International Data Transfer Addendum to the EU standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep it
| Data | How long |
|---|---|
| Your account, linked accounts, email addresses, settings, tiers, lists, notes and triage | until you delete your account. Lists, notes, dismissals and pinned people you delete are marked deleted for 30 days, so your other devices see it, and then deleted |
| Tokens | until you unlink that account or delete your account; we revoke them on the forge first where it lets us (GitHub, GitLab). If you revoke the GitHub App on GitHub, we delete your GitHub tokens straight away. If you revoke another app on the forge, the token stops working, but the encrypted copy stays until you unlink or delete. None while you're on the waitlist |
| Sessions | 30 days, or until you sign out |
| Sign-in state | 10 minutes in a cookie, and up to an hour on our server |
| Your notifications | while a forge still lists them; once none does and their issue or pull request is gone or closed, 90 days after their last activity |
| The log of writes you made | until your account is deleted; the text you wrote, 7 days after it was sent or failed |
| Poll logs | 30 days |
| Invites | 30 days after they're used |
| Your ban log | 30 days after you undo a ban |
| Security data you can see | until you're no longer a confirmed admin, or the repo leaves the install or goes private. Once no confirmed admin is left, we delete the repo's security data |
| Public forge data (threads, comments, reviews, events, profiles) | while the repo is stored. Comment and review text, 7 days; after that your browser reads it from the forge. Profiles nothing refers to any more, 90 days |
| Raw webhook deliveries | the payload until processed (usually seconds); a record of the delivery for 14 days |
| AI answers and embeddings | until the issue or pull request is deleted from our database |
| Usage counts per owner and day (no content) | 90 days, then daily totals with no owner |
| Server logs | 1 day |
| Backups | 30 days |
Security
Tokens and sign-in state are encrypted with AES-256-GCM. Session cookies are sealed, HttpOnly and Secure. Your own data reaches your browser only through a proxy that checks your session, and security data is marked so browsers don't cache it. Security data is checked against GitHub with your own token and deleted when access can't be confirmed. Server logs carry codes and ids only: never forge text, logins, email addresses or tokens. No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the ICO where the law requires.
On your device
The app keeps a copy of your data in your browser (IndexedDB, localStorage and the service worker cache) so it works offline: synced rows, your unsent changes, drafts, cached comments and files, and translations. When you sign out, the app deletes these copies and asks the browser to clear its cache and all of its storage for the site, drafts included; if you have unsent drafts or changes, it tells you before it deletes them. Deleting your account does the same and also removes the app's preferences from that browser. If someone else signs in on the same browser, the app deletes your data first.
The browser also remembers the sign-in method you used last, in localStorage, so we can show that one first next time. Nothing about it is sent to us.
The command palette remembers the last ten threads you opened on this device, in localStorage under mdev:recent-threads, so it can offer them again. The key holds subject ids only, never a title or a body, and nothing about it is sent to us.
We use four cookies, all first-party and all needed for signing in:
| Cookie | What it holds | How long |
|---|---|---|
mdev_session | your sealed session id | 30 days |
mdev_signed_in | only that you're signed in, with nothing that identifies you, so a page can send you to sign in before it shows | 30 days, cleared when you sign out |
mdev_oauth | sealed sign-in state | 10 minutes |
mdev_invite | an invite code during sign-in | 1 hour |
Analytics. We use Vercel Web Analytics to count page views, so we can see which parts of the app are used. It sets no cookies. Instead of identifying you, it uses a hash of your request that changes every day, so a visit can't be linked to you or to your visits on other days. We send only the kind of page you viewed, with repo, thread and person names replaced by placeholders, and never the query string or anything after #. We send no custom events and nothing about your account. The data is processed by Vercel Inc. as our processor and kept for the retention period of our Vercel plan.
We use no advertising or third-party cookies. Images in comments load only when you click them, so their hosts don't see you just for opening a thread. Avatars load from GitHub.
Your rights
Under the UK GDPR you have the right to:
- access a copy of your data;
- correct data that's wrong;
- delete your data;
- restrict how we use it;
- object to uses based on legitimate interests, including the public forge data and the automation estimate described above;
- move data you gave us to another service.
To use any of these, email contact@poetry.sh from an address we have for you, or tell us your forge login so we can check it's you. We'll reply within one month. There is no fee.
What you can do yourself today:
- Sign out on each device to delete the copy in that browser.
- Download your data in Settings › Account › Export my data (on the waitlist page while you wait): a JSON file of everything we store for your account, without tokens or other people's data.
- Unlink an account in Settings › Linked accounts. This revokes that account's tokens on the forge where it lets us, and deletes them. You have to keep at least one.
- Change or remove your waitlist email on the waitlist page.
- Revoke our access on the forge:
- GitHub: Settings › Applications. Under "Authorized GitHub Apps" and "Authorized OAuth Apps", revoke maintainers.dev; revoking the GitHub App deletes your GitHub tokens here and signs you out. Under "Installed GitHub Apps" (yours or your organisation's), uninstall it. Uninstalling deletes that owner's data from maintainers.dev.
- Codeberg: Settings › Applications.
- GitLab: Preferences › Applications.
- Atmosphere: your PDS's app settings, or unlink Tangled in Settings.
- Delete your account in Settings › Account, or on the waitlist page while you wait: type your login to confirm. We revoke our access on every forge you linked where it lets us, delete your account and every row linked to it, sign you out everywhere, and delete the copy in that browser. What you wrote in public on a forge stays on the forge, and in our copy of that public repo while we store it. Backup copies expire on their own schedule (see above). Sign out on your other devices to delete their copies. We remove the webhooks you connected on Codeberg or GitLab before we revoke your tokens there. Unlinking a Codeberg or GitLab account does the same, unless another of your accounts there can manage the webhook, which then takes it over. If you installed the GitHub App for an organisation, another admitted admin of it takes the installation over; if there is none, we stop syncing that organisation and delete its data.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Children
maintainers.dev is for people who maintain open-source projects. It isn't meant for children. You must be old enough to hold an account on the forge you sign in with, and at least 13. If you think a child has given us data, email us and we'll delete it.
Changes
We'll update this policy when the app changes what it does with data. We'll change the date at the top, and for significant changes we'll tell you in the app or by email before they take effect.
Contact
The Poetry Company Limited
Fernwood House
Fernwood Road
Jesmond, Newcastle upon Tyne, NE2 1TJ
United Kingdom