Privacy

What we read

• Vouch lists. Public VOUCHED.td files in public GitHub repositories: the handles listed, whether each is vouched or denounced, and any note the project wrote.
• Who made each decision. The author of the commit that last changed a line, only when GitHub links that commit to an account. Otherwise it is shown as unknown.
• Public profile and activity. For a profile page: the GitHub login, name and avatar, and public pull requests, reviews and issues.

We only read data that is already public on GitHub. We don't collect anything from other sources and we don't combine it with anything outside GitHub.

What we keep

There is no database. Data is read from GitHub when someone looks it up and cached in the server's memory for a few hours to a few days, so that repeat lookups don't hit GitHub's limits. AI summaries are kept in memory too, up to the 500 most recent. All of it is lost when the server restarts.

AI summaries

When a signed-in visitor opens a profile, the person's public pull requests, reviews and issues are sent to Groq, a model provider based in the United States, to write a short summary of their public work. The summary cites links to the original activity. It doesn't rate the person, and it doesn't recommend vouching for or denouncing them.

No scores, no automated decisions

Vouch Explorer doesn't compute a reputation score and doesn't vouch for, denounce, block or approve anyone. Every decision shown was made by a project's maintainers in their own repository. Whether to act on it is up to whoever is looking.

Signing in

You can sign in with GitHub. We ask for no extra permissions. After sign-in, your login, name, avatar address and GitHub access token are kept in an encrypted cookie in your browser for 30 days, or until you sign out. The token is only used to read public GitHub data on your behalf, so lookups count against your own GitHub limit instead of ours. It is never stored on the server.

Cookies and storage

• session: keeps you signed in, as described above.
• oauth_state, oauth_next: used during sign-in, deleted after 10 minutes at most.
• theme in your browser's local storage: remembers light or dark mode.

There are no analytics, ads or tracking cookies.

Why we process this data

Under the GDPR, our basis is legitimate interest (Article 6(1)(f)): helping maintainers see trust decisions that other projects have already made public, so they can judge contributions to their own projects. For signed-in visitors, it is also providing the sign-in you asked for.

Your rights

You can ask to see what Vouch Explorer shows about you, to have something corrected, to object, or to have your profile hidden. To do so, open an issue on our repository. You don't need to give a reason.

We can hide you from Vouch Explorer, but we can't change another project's VOUCHED.td. If you think a project vouched for or denounced you by mistake, ask that project's maintainers. Once their file changes, Vouch Explorer will show the change after its cache expires.

If you live in the EU, you can also complain to your data protection authority. In Italy that is the Garante per la protezione dei dati personali.

Changes

If this policy changes, we will update this page and the date at the top. See also the terms of use.