Privacy policy

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Email: [email protected]

Visiting the site

When you open a page, your browser sends your IP address, the page requested, the time, the referring page and your browser's user agent. The web server and the application write these to log files to deliver the site, find errors and fend off abuse. The logs are rotated and deleted automatically and are not combined with other data. From them we count aggregates for ourselves, such as page views per hour, pages, browsers, referring sites and link previews, and keep these counts in our database; they hold no IP addresses or user agents. To count unique visitors per day we store a keyed hash of IP address and user agent for at most two days. The key is random, new each day and deleted together with the hashes, so nothing stored can be traced back to an IP address or user agent. None of this is linked to accounts. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in running a secure site.

Fonts, scripts and stylesheets are served from stak.sh itself. There are no analytics scripts, no advertising and no tracking pixel.

Cookies

stak.sh only sets cookies that are strictly necessary, so no consent banner is needed (§ 25(2) TDDDG):

• stak_csrf: protects forms against cross-site request forgery; set on pages with forms.
• stak_session: keeps you signed in, for up to 30 days or until you sign out.
• stak_oauth_state: protects the GitHub sign-in against forgery; lasts only for the sign-in.
• stak_signup: remembers an unfinished signup for up to 30 minutes.
• stak_welcome: shows a one-time welcome note after signing up; lasts 10 minutes.

Signing in with GitHub

You sign in with your GitHub account. GitHub then sends us your GitHub user ID, username, email address, avatar URL, account creation date and number of public repositories. We use them to create and secure your account, to check whether the account counts as verified (at least 90 days old with a public repository), and to email you about your account if needed. Your email address is never shown publicly. After sign-in, the names, languages and manifest files of your recently pushed public repositories are read once to suggest tools for your stack; nothing is added without your confirmation, and no private repository is accessed. Legal basis: Art. 6(1)(b) GDPR, providing the service you signed up for.

GitHub is operated by GitHub, Inc., USA. Its privacy statement applies to your use of GitHub. Transfers to the USA rest on the EU-US Data Privacy Framework, under which GitHub is certified.

Your profile

What you enter on your profile (display name, bio, links, tools, how long and how well you know them) is published at stak.sh/@you while your profile is public. You can make it private, hide your GitHub link and opt out of the community statistics at any time in your settings. Community statistics are published only as aggregates over at least 30 profiles.

Profile pictures are your GitHub avatar, loaded from GitHub's servers (avatars.githubusercontent.com). Viewing a page with avatars therefore sends your IP address to GitHub. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing who a profile belongs to without storing copies of images.

Researched stacks: people without an account

For a small number of well-known developers, stak.sh publishes researched stacks at addresses ending in -editorial. For these we process the person's name, public profile picture (when enabled, loaded from GitHub's servers like the avatars above), job description, public links and the tools they have publicly said they use. All of it comes only from what they published themselves, such as their own posts, repositories, talks and interviews, and every page lists these as its sources. Nothing about them enters the community statistics. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in reporting on publicly available developer tooling, and the journalistic purpose of these pages.

If you are shown on such a page, you can object at any time (Art. 21 GDPR) and ask for a correction or deletion through the report form on the page or at [email protected]. The page will then be corrected or removed.

Reports and suggestions

When you report a profile or suggest a change, we store the reason, your message and, if you are signed in, your account, to review the report. Reports are deleted once they are handled and no longer needed. Legal basis: Art. 6(1)(f) GDPR, keeping the site free of abuse.

Contacting us

If you email us, we use your address and message only to answer you and delete them when the conversation is over, unless we must keep them by law. Legal basis: Art. 6(1)(b) or (f) GDPR.

Deleting your account

You can delete your account in your settings at any time. Your profile, tools and account data are deleted right away and your profile drops out of the community statistics with the next nightly rebuild.

Hosting

stak.sh runs on a rented server. The hosting provider processes data only on our behalf under a data processing agreement (Art. 28 GDPR).

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). Write to [email protected] to use them. You can also complain to a data protection supervisory authority, in particular the one where you live or work.

There is no automated decision-making within the meaning of Art. 22 GDPR.

Last updated: November 2026.