Privacy

Short, because there is not much to say.

What we read on GitHub

Sign-in goes through a GitHub app set to “public data only”: it tells us who you are, nothing else. A public repo is read the way anyone can read it on github.com: the name, description, language, website, and the commit dates on the default branch. No permission is asked for that, and no token is kept.

A private repo requires installing the “Not a Cent” GitHub App on it, with a single permission: “metadata”, read-only. GitHub then only shows us its statistics, commit counts per week and per day, never the contents, never a line of code. Only the numbers that come out of it are public. The site is open source, anyone can check: metrics.ts.

What we keep

• The maker's GitHub login, numeric id and avatar, to show “by @login”.
• No token in your name. Public repos are re-read every night with the site's own token, private repos through the app installation.
• The four card fields: link, image, what took the longest, main tool.
• A signed session cookie, to stay signed in. No third-party cookie and no ad tracker. Visits are counted by Vercel Web Analytics, the host's own tool, and by Umami, an open-source tool we host ourselves in Europe: page views, referrers, country and device type, as aggregate numbers, with no cookie and no IP address kept.

“Nice one” and clicks are counted per app, never per person. So that a “nice one” counts only once, we keep a fingerprint of the IP address (a keyed hash the address can't be recovered from) next to the app, nothing else.

Unclaimed cards

Some cards are created by us, by hand, from a public repo: the name, description, language, website and commit dates GitHub shows to everyone. They are marked “unclaimed”, carry no badge and no dofollow link, and the maker can take them over by signing in with GitHub. We write once, to the public email on their GitHub profile (or, failing that, the one on their commits), to let them know. That address is used for this one email only and deleted as soon as they reply or claim the card. Never a follow-up. A “no” in reply is enough: the card disappears and the repo is never listed again. Legal basis: our legitimate interest in showing public work, with your right to object in one reply.

Assistants (ChatGPT, Claude…)

Not a Cent exposes a public, read-only MCP server (/api/mcp). An assistant can search apps, read a card or the board: exactly what this website already shows, nothing more. No data from the assistant or its user is stored; there is no account and no token on that side. Listing an app always goes through this site and GitHub.

Removing your app

From your card, the “remove” button, or write to the address below: the card and the numbers are deleted. Card images leave the cache within five minutes.

Who

Not a Cent is handmade by an independent developer in France. Hosted on Vercel, database at Neon (Europe). Contact: meffysto@gmail.com.

Last updated: September 27, 2026.