Privacy policy
Last updated 22 August 2026. Effective immediately.
TopMe.dev is operated by the owner at @automatethebs on X. Contact us there for privacy requests. We are the data controller for data we store on our servers.
What we store
When someone submits a GitHub username we fetch public GitHub data via the GitHub API: login, display name, avatar URL, profile URL, public repo count (forks excluded), total stars on owned repos, followers and following, recent public events count for the last 90 and 30 days, account age in days, primary languages, bio, company, location, blog, X/Twitter handle, hireable flag, and top starred repos. We compute a score from that and store the JSON payload, score, verified flag, and updated time in our database (Cloudflare D1 / SQLite). We do not store private emails from GitHub, private repo data, or passwords.
GitHub OAuth for verification creates a user row (email, name, image from GitHub), an account row (GitHub user ID, access token), and a session row. We also store a mapping user_id → github login to check ownership without calling GitHub on every page view. Access tokens are kept server-side and never exposed to the client.
What we do not store
Private repository contents, private emails, payment cards, or login sessions beyond the OAuth cookies needed for verification. Submitting a profile does not give us access to private repositories. Scores are derived only from public data and are a visibility signal, not a hiring evaluation.
Cookies and ads
We use Google AdSense Auto ads to keep the board free. Auto ads loads https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js only after you click Accept in our cookie banner. Until then, Google tags are set to ad_storage=denied via Consent Mode v2. If you click Reject, we keep ads denied and do not load personalized ads.
When ads are accepted, Google may set cookies and collect device or usage data to serve and measure ads. Google is a separate data controller for that. See the Google Privacy Policy and Google advertising and manage personalization at adssettings.google.com. Our ads.txt at /ads.txt lists our publisher ID.
You can change your choice anytime via the Cookies link in the footer. Clearing topme-consent-v1 from localStorage also resets the banner. Theme preference (theme in localStorage) is unrelated to ads and never sent to Google.
We also use Google Analytics 4 to understand page views, referrers, and device type. Analytics is on by default and sets first-party Google Analytics cookies (_ga) to count visits; advertising cookies stay off until you click Accept. Clicking Reject (or the Cookies link in the footer) turns analytics off too. GA4 does not store IP addresses, and never sends your GitHub login or email. No PII is collected. See How Google uses data from partner sites and opt out via GA Opt-out.
Legal basis and retention
We process public GitHub data on the basis of legitimate interest (running a public opt-in leaderboard) and process ad-related data on the basis of consent where required (EEA). Profiles stay until the verified owner removes them via the Danger zone on their profile page, or until we remove them for abuse. GitHub OAuth sessions follow better-auth defaults and are deleted on sign-out. You can request deletion of a listing at any time via the contact page; we act promptly.
Your rights
You may request access, correction, or deletion of data we hold about you, and you may withdraw consent for ads by clicking Reject in the banner or footer. To exercise rights or ask about a listing, use the contact page or DM @automatethebs.
Removal
If you verified ownership of your profile with GitHub, you can remove it yourself from your profile page (Danger zone → Remove my profile). Verified removal is instant, deletes your payload, score, and ranking, and cannot be undone — but you can re-add later with “Rank me”.
For unverified listings or to ask that another listing be removed, use the contact page. We review and act quickly, especially for impersonation or harassment.
Children
TopMe.dev is not directed at children under 16 and we do not knowingly collect their data.
Changes
We will update the date above when this policy changes and keep the history in git.