Privacy Policy

StarMapper is operated by Florian Bruniaux, an individual based in France.

Contact for privacy matters: florian@bruniaux.com

As a French operator, StarMapper falls under the jurisdiction of the CNIL (Commission Nationale de l'Informatique et des Libertés) and is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR).

StarMapper accesses publicly available data from the GitHub API for any repository you choose to scan. For each person who starred that repository, we collect:

• GitHub username (login) — a public identifier
• Display name — optional, publicly visible on GitHub profiles
• Self-declared location — free-text field on the GitHub profile (e.g. "Paris, France")
• Follower count — publicly visible metric
• Star date — when the user starred the repository
• Geocoded coordinates (lat/lng) — derived from the location field above, via third-party geocoding services, to place the user on the map

We do not collect email addresses, private repository data, or any information not publicly visible on GitHub profiles.

All data is retrieved via the GitHub GraphQL and REST APIsusing authenticated requests. We do not scrape the GitHub website (HTML). The GitHub API is the authorised programmatic channel for accessing public user data, as described in GitHub's Terms of Service and API documentation.

Location text is then sent to third-party geocoding services — Jawg Places, Geoapify, and Nominatim (OpenStreetMap) — to resolve coordinates. Results are cached in our shared geocoding database to avoid redundant API calls.

The sole purpose of processing is to provide StarMapper's core functionality: visualising the geographic distribution of stargazers for any public GitHub repository on an interactive map, with country and city statistics.

Data is not used for advertising, profiling, resale, or any purpose beyond repository analytics.

Processing is based on Legitimate Interests (GDPR Article 6(1)(f)).

Our interest: providing developers with a free tool to understand the geographic reach of their open-source projects, using publicly available GitHub data.

Balancing test: all data collected is already public on GitHub; users who wish to control their location visibility can remove or modify the location field on their GitHub profile at any time. StarMapper displays data in aggregate (clusters on a map), not as searchable individual records. The processing is transparent and the tool is free and open-source.

We have concluded that our legitimate interest is not overridden by the rights and freedoms of data subjects, given the public nature of the data, the aggregate display, and the availability of opt-out mechanisms described below.

User profile records (github_user table) and star event records (star_event table) are automatically deleted after 12 months from the date they were last fetched. A monthly automated job purges records older than this threshold.

The geocoding cache (geocache table) maps location strings to coordinates and is not linked to individual users. It is retained indefinitely to avoid redundant API calls; it contains no personally identifiable information beyond the location text.

Deletion request audit logs (deletion_log table) are retained for 3 years to demonstrate regulatory compliance.

We rely on the following third-party service providers, each processing data on our behalf:

Data transfers to providers located outside the EU (Neon, Vercel) rely on Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR Chapter V.

StarMapper sets one technical cookie: sm_token, used exclusively for security purposes (HMAC-signed request authentication). This cookie is strictly necessary for the service to function and does not track your browsing behaviour across sites.

No analytics cookies, no third-party tracking pixels, and no advertising identifiers are set. No cookie consent banner is required.

StarMapper also stores your theme preference (starmapper:theme) in localStorage, which is not a cookie and not transmitted to any server.

As a data subject under GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of all data we hold about your GitHub account
• Right to erasure (Art. 17) — request deletion of your data from our systems
• Right to object (Art. 21) — object to our processing based on legitimate interests
• Right to restriction (Art. 18) — request that we restrict processing while a dispute is resolved
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format

To exercise any of these rights, send an email to florian@bruniaux.com with your GitHub username and confirmation that you are the account holder. We will respond within 30 days.

You also have the right to lodge a complaint with the CNIL: cnil.fr/fr/plaintes.

Send an email to florian@bruniaux.com with:

• Subject: GDPR Data Deletion Request
• Your GitHub username
• Confirmation that you are the account holder

We will delete your profile data, star events, and recalculate any affected aggregations. You will receive a confirmation email once the deletion is complete, within 30 days of your request.

Simpler alternative: remove or change your location field in your GitHub profile settings. The next scan of any repository you've starred will use your updated (or absent) location.

If we make material changes to how we process your data, we will update the "Last revised" date at the top of this page. Continued use of StarMapper after changes are posted constitutes acceptance of the updated policy.