Privacy policy.

These items are written to your browser's localStorage under keys prefixed agenthub.*. They never leave your device and clearing your browser data removes them permanently:

• Saved projects and organizations - the stars and follows you tap on cards.
• A local copy of your signed-in display name and provider, so the dashboard can greet you and still work offline.
• Preferences - light or dark theme and the dashboard notification toggles.
• Application drafts and watchlists you build in the dashboard.

On the server side, signing in stores one thing: a signed session cookie (cyrus.session, httpOnly, valid 30 days) holding your display name, your sign-in provider and an id derived from your account. It is not a profile, it is not readable without the server's signing secret, and signing out deletes it. If a database is attached to the deployment, an account row is also kept with the name, email, avatar and provider your provider sent us, so saves can follow you between devices; that is currently not attached, so nothing about you is kept in a database.

Google sign-in is optional and uses the standard OAuth redirect. Google returns a token to the site; that token is sent to /api/auth/google, where the server checks with Google that it was really issued for this client before anything is stored. We receive your name, email address, profile-picture URL and Google account id - basic profile, nothing more. Those go into the session cookie and into the local session copy; a database row is only written when one is attached to the deployment. We never see your Google password, and we do not request access to any other Google data.

Email sign-in is the same trade in the other direction: you type an address, the server keeps a one-way hash of the six-digit code it sends (through Resend, an email provider, for ten minutes with a capped number of tries) and, once you enter the code, issues the cookie above. The address itself is what identifies your account on that path; nothing else about your browsing is attached to it.

Because this is a catalog of real open-source work, pages load some assets from third parties, which means your browser makes requests to them (your IP address is visible to them, as with any website visit):

• GitHub - organization and repository avatars are fetched from GitHub's image CDN.
• Google - accounts.google.com serves the consent page while you are signing in, and your profile picture is loaded from Google's image CDN afterwards.
• Outbound links - program and repository cards link to organizers' and maintainers' own sites; their privacy practices are theirs, not ours.
• Our own server - only the sign-in endpoints are called by name. Those requests go to the site's host (Vercel), which records ordinary request metadata such as an IP address in its platform logs; the catalog pages themselves are served without any per-visitor storage.

No advertising networks, no analytics scripts, no heatmaps, no session recording, no email marketing list, and no sale or sharing of personal data. The only address that ever reaches us is the one you type into email sign-in, and the only use made of it is sending your code. Sign in with Google instead and no email address is stored by us at all beyond the claims in your session.

The site is a general developer resource and is not directed at children under 13. If you believe a child's data reached us through some unexpected path, contact us and we will remove it.

This page is rewritten and re-dated whenever the data flow changes, not after. Signing out clears the session cookie; if a database is ever attached, deleting your account will also delete its row - ask through the links at the bottom of this page or an issue on the project's GitHub, and the same route works today for anything that is already stored.