What commits.sh stores, what it never sees, and how to delete everything.
Tickers, charts, ranks, and leaderboards are computed from GitHub's public API, the same contribution counts anyone can see on your profile. We cache them briefly to render pages. Nothing here is private, and nothing requires an account.
If someone made their Cursor profile public at cursor.com/@handle, we fetch the same numbers that page already shows (joined date, 30-day tokens, heatmap activity, local/cloud agents, streaks, models, and the links they added). Successful public fetches are stored in a directory so /cursor can rank them. We also warm-probe first-name handles and GitHub bios that already publish cursor.com/@handle. Team-only and private Cursor profiles are not requested. This is not the Mac app stream and is not used to settle markets. The optional browser overlay on cursor.com/@handle only talks to commits.sh. If the Cursor profile lists a GitHub account, we also load that public GitHub contribution tape — the same numbers already shown on commits.sh/{login}.
We store your GitHub login, avatar URL, and the time you verified. Sign-in uses GitHub OAuth with read-only profile access; we can't touch your repos.
Each report contains, in full:
Never sent, by design: prompts, code, file paths, repo names, your computer name, local username, or hardware serial numbers. The random installation ID is hashed by the server before storage and exists only to prevent two collectors from double-counting the same cumulative pulse. Both collectors are open source. Read them.
Cursor tracking is optional and uses Cursor's official aggregate usage export. The app reads your existing Cursor session locally and sends it only to cursor.com; commits.sh never receives that credential or the raw export. Monotonic day/model aggregates are kept locally so a shorter export cannot reduce your totals, and disconnecting deletes that local Cursor ledger.
The /outbid board is paid placement. We store the GitHub handle you bid on, the amount paid, a cached avatar/name/bio from GitHub, and click counts on that row. It never changes the developer leaderboard. Payment details stay with Polar or Stripe.
One click on /connect revokes every device you've paired and deletes every byte of streamed telemetry. Immediately, no support ticket.
No ad trackers, no fingerprinting, no selling data. Standard server logs and edge caching only.