Privacy Policy

Data we process

For developers, we process information made publicly available: public GitHub profiles (username, display name, profile bio, company, location, public links, and, where a user has made it discoverable, an email address), public commit metadata, and public package registries such as npm. We do not access private repositories or anything behind authentication, and we honour requests to remove or suppress your information (see below).

For customers, we process your account email, GitHub identity, billing details, and basic usage so we can run and bill the Service.

Lawful basis

We rely on legitimate interest to process public developer data for business-to-business outreach: connecting maintainers and developer-tool teams with people who have already signalled relevant interest by starring a repository. We balance that interest against the rights of the people involved, only process public data, and make opt-out simple and immediate. For account and billing data we rely on contract and legal obligation.

How your data is shared

Contact records are surfaced only to the customer who ran the scan. We do not build a shared, resellable contact database, and we do not sell data to third-party data brokers. That said, providing enriched contact records to a paying customer can qualify as a “sale” or “share” of personal information under some privacy laws, such as the California Consumer Privacy Act. Where those laws apply to us, we comply with them, including any registration they require and honouring the right to opt out.

Your rights: opt out, access, or delete

Anyone can suppress their email or GitHub login from all future scans (no account needed) via our opt-out page. Once suppressed, we will not emit that contact again at index or scan time, and the suppression is permanent across every future scan. Customers can permanently delete their own account and data from Settings, on the Compliance tab.

Depending on where you live, you may also have the right to access, correct, delete, or object to our processing of your data, and to opt out of its sale or sharing. To exercise any of these, use the opt-out page above or email us below.

Retention and security

We retain resolved contact records only as long as needed to provide the Service, and suppression records for as long as needed to keep honouring an opt-out. Data is encrypted in transit and access is limited to what operating the Service requires.

Who we are, and contact

WarmStars is the controller for the processing described here. For any privacy request, reach us at privacy@warmstars.com. We respond to verified requests within 30 days.