Counts and costs. Never content.

Tickers, charts, ranks, and leaderboards are computed from GitHub's public API, the same contribution counts anyone can see on your profile. We cache them briefly to render pages. Nothing here is private, and nothing requires an account.

If someone made their Cursor profile public at cursor.com/@handle, we fetch the same numbers that page already shows (joined date, 30-day tokens, heatmap activity, local/cloud agents, streaks, models, and the links they added). Successful public fetches are stored in a directory so /cursor can rank them. We also warm-probe first-name handles and GitHub bios that already publish cursor.com/@handle. Team-only and private Cursor profiles are not requested. This is not the Mac app stream and is not used to settle markets. The optional browser overlay on cursor.com/@handle only talks to commits.sh. If the Cursor profile lists a GitHub account, we also load that public GitHub contribution history — the same numbers already shown on commits.sh/{login}.

The token leaderboard also shows lifetime token totals people published on other public AI-usage leaderboards, matched to a GitHub account by that account's public profile. We keep the public row as that board shows it (name, avatar, token totals and estimated cost), the GitHub login and when we read it.

To hide your row on the leaderboard and your profile, sign in with GitHub and choose Revoke all devices and delete shared data under connection settings on /connect (this also deletes anything you streamed), or email hello@commits.sh.

We store your GitHub login, numeric account ID, avatar URL, and the time you verified. Sign-in uses GitHub OAuth with read-only profile access; we can't touch your repos.

The iPhone app uses a separate, expiring sign-in session and stores the GitHub handles you add to your watchlist so the list is available when you return. Your GitHub display name, handle, and numeric ID identify your account. We use this information to provide the app, not for advertising or tracking. Provider credentials entered on your iPhone stay in its Keychain and are sent only to the provider required for that connection.

This is a separate choice in the Mac app. We store each connected provider's name, plan label, usage percentages, reset times, connection status, any reported additional Codex credit balance, and the time your Mac checked them. Your signed-in iPhone can read those limits; they are not added to your public profile or charts. Provider logins, credentials, prompts, code, and token totals are not included in this private report.

The server keeps the latest private report for up to 7 days after the last upload, then deletes it automatically. Stopping sync on a Mac revokes that Mac. Use Remove private Mac limits on your iPhone, or disconnect on /connect, to revoke every Mac and delete the saved report sooner. Pairing requires your verified GitHub account; private reports are bound to its numeric ID so a changed login cannot transfer access to another account.

A minimal revocation marker containing your numeric GitHub ID remains after deletion so older pairing codes and collector tokens cannot restore a deleted report. It contains no usage readings.

Each report contains, in full:

• · token counts (input / output / cache)
• · API-equivalent cost totals
• · model names and your plan tier
• · coarse system health and a random installation ID

Never sent, by design: prompts, code, file paths, repo names, your computer name, local username, or hardware serial numbers. The random installation ID is hashed by the server before storage and exists only to prevent two collectors from double-counting the same cumulative pulse.

Cursor tracking is optional and uses Cursor's official aggregate usage export. The app reads your existing Cursor session locally and sends it only to cursor.com; commits.sh never receives that credential or the raw export. Monotonic day/model aggregates are kept locally so a shorter export cannot reduce your totals, and disconnecting deletes that local Cursor ledger.

Your totals, history and daily rows are public on your profile and the leaderboard, and are kept for 400 days after your last upload. Activity charts and signed collector records stay until you disconnect, which deletes all of it at once.

Repository reach is private to your verified GitHub account. It stores the repositories you select, their visibility, daily views and clones, per-repository unique counts, and top referral sources. Saved daily observations cover up to 365 UTC dates; missing days are not estimated.

Your separately supplied fine-grained GitHub token is encrypted on the server, bound to your numeric GitHub ID, and sent only to GitHub. It is not included in dashboard responses or exports. Background checks continue until you disconnect. Disconnecting repository reach deletes the saved token and traffic history; deleting your commits account removes them too.

Brief request-limit markers may remain until their deadline after disconnecting, so reconnecting cannot bypass GitHub’s rate limits. They contain no token or traffic. Downloaded reports stay on your device. Exports exclude private and unverified repositories unless you explicitly include them; repository traffic does not appear on your public commits profile.

The /outbid board is paid placement. We store the GitHub handle you bid on, the amount paid, a cached avatar/name/bio from GitHub, and click counts on that row. It never changes the developer leaderboard. Payment details stay with Polar or Stripe.

One click on /connect after a fresh GitHub sign-in revokes every device you've paired and deletes streamed telemetry and private phone limits. Immediately, no support ticket.

Open You → Delete account in the iPhone app, or visit Delete account. After verifying your GitHub identity, confirm deletion to remove your commits account, watchlist, and synced telemetry, private limits, and repository traffic connections. Existing sessions and connected upload devices are revoked. Minimal account and device revocation records remain so older credentials cannot restore deleted data.

This does not delete your GitHub account, repositories, or independently public GitHub statistics. Direct provider connections on your devices are separate; remove them in their account details.

No ad trackers, no fingerprinting, no selling data. Standard server logs and edge caching only.