---
title: "Privacy"
description: "What GitBanners reads from GitHub, what it stores when you sign in, which cookies it sets, who else is involved, and how to delete your account."
canonical: https://gitbanners.com/privacy
last-updated: 2026-11-13
---

# Privacy

GitBanners draws banners from public GitHub data. You can use all of it without an account, and when you do sign in, very little is kept. This page lists all of it.

## The short version

- Banners use public GitHub data only. Nothing private is read.
- No account is needed. Signing in is only for saving banners and for Pro.
- Sign in with GitHub asks for no permissions beyond your public profile, and the access token is never stored.
- No advertising, no tracking cookies, no sale or sharing of personal data.
- You can delete your account from the dashboard. It is removed at once.

## Banners and public GitHub data

A banner shows what GitHub already shows to anyone: a public profile, public repositories, the public contribution calendar. Anyone can make a banner of any public account, in the same way anyone can open its GitHub page.

- Data read from GitHub is cached for up to 15 minutes. A last good copy is kept for up to 7 days, so a banner still draws when GitHub cannot be reached.
- Private repositories are never read or named. If you turned on "Private contributions" in your GitHub profile settings, GitHub adds those counts to your public calendar, and a banner shows them as counts only.
- To change or remove what a banner shows, change it on GitHub. The banner follows.

## Visiting the site

- As with any website, the hosting provider processes your IP address and browser details to deliver pages and images.
- Rate limiting counts requests per IP address in short windows, to keep the API and sign-in usable for everyone. An IPv6 address is counted as its /64 network. The counters expire with their window.
- Vercel Web Analytics and Speed Insights measure page views and loading speed. They set no cookies.
- Your light or dark theme choice is kept in your browser's local storage. It is not sent to the server.

## Signing in with GitHub

Signing in is optional. It asks GitHub for no permissions beyond your public profile. GitHub hands the site an access token; it is used during that one request to read your public identity and to check whether you starred the repository, and is then discarded. It is never stored.

Stored for each account:

- Your numeric GitHub id, login, display name and avatar URL.
- Whether the account has Pro, and when that was last checked.
- The banners you saved: a name, the target, the preset and the options.
- When the account and each banner were created and last changed.

No email address, no password, no repository access and no payment details are collected.

## Cookies

Cookies are set only when you sign in. There are three, all first-party:

| Cookie | What it is for | Lifetime |
| --- | --- | --- |
| `gb_session` | The signed session: your GitHub id, login, name and avatar URL. Not readable by scripts. | 30 days, renewed while you keep using the site |
| `gb_in` | The value "1", readable by scripts. It tells a page that someone is signed in, so pages ask for account data only when there is some. | Same as the session |
| `gb_signin` | The state of one sign-in attempt, so the answer from GitHub can be matched to the browser that asked. | 10 minutes |

On the live site the names carry a `__Host-` prefix. Signing out removes the session cookies.

## Who else is involved

| Provider | What for | Where |
| --- | --- | --- |
| Vercel | Hosting, the CDN, Web Analytics and Speed Insights. | Functions run in Washington, D.C. |
| Upstash | The Redis database for accounts, saved banners, cached GitHub data and rate limit counters. | US East |
| GitHub | The source of all banner data, and sign-in. | github.com |
| Google Fonts | When a banner contains characters that Mona Sans cannot draw, those characters are sent to Google Fonts to fetch a font that can. | Requested by the server |
| jsDelivr | Emoji artwork (Twemoji) for emoji that appear on a banner. | Requested by the server |

The requests to Google Fonts and jsDelivr are made by the server while it draws an image, not by your browser, so those providers do not see who is looking at a banner.

## Retention and deletion

- Account data is kept until you delete the account.
- Deleting the account from the dashboard removes the account record, every saved banner and the Pro status, and signs you out. It happens at once and cannot be undone.
- Signing out removes the session cookies and keeps the account.
- Cached GitHub data expires by itself, after 7 days at the latest.

## Questions and changes

For anything this page does not answer, see the [contact page](https://gitbanners.com/contact). When the product changes in a way that affects this page, the page changes with it, and the date at the top is updated.