This instance of Starring is run by Pipoline s.r.o., Zavada 30, Levoca, Slovakia (the “controller” under the GDPR). Questions or requests: hello@starring.dev. Starring is open-source software; this notice describes how this site uses it.
The short version
- Your profile is what you choose to publish. Drafts are private until you press Publish.
- Imports from GitHub, LinkedIn exports, JSON Resume and
starring-cli scanare converted in your browser. For LinkedIn, only profile, positions, education, skills, projects and certifications are read — messages and connections are never opened. - No advertising, no selling data, no third-party trackers — only cookieless, aggregate page-view statistics.
- You can delete your account at any time from Account; it removes your profile and everything stored about you.
What we store
- Account: name, email address, a hashed password (if you use one), whether your email is confirmed, and sign-in sessions (with IP address and browser, to keep you signed in and protect the account).
- Access requests (while sign-ups are invite-only): the email, name, link and note you leave, used only to decide on and send your invite. Deleted with your account, or on request.
- Sign-in with GitHub or GitLab: your account id there and the access token it issues, used only to import your public profile and contribution counts when you ask, and for the weekly GitHub check below.
- Your profile: the content you enter or import — name, role, clients, projects, timeline, education, skills, links and commit counts — and whether it is published.
- Weekly GitHub check (live stages, unless you turn it off in Account): once a week we look up your GitHub account — your repositories, organisations, merged pull requests, stars and yearly contribution counts — and keep the latest result, plus the suggestions you dismissed, to offer under Find updates. Nothing from it appears on your stage unless you add and publish it. Replaced by each new check; deleted with your account.
- Reports: if you report a profile, the reason and details you give.
Why (legal basis)
- To provide the service you signed up for — your account and your public profile (contract, Art. 6(1)(b) GDPR).
- To keep the service secure and free of abuse — rate limiting, session records, handling reports (legitimate interest, Art. 6(1)(f)).
- To send emails you need — password reset and address confirmation. No newsletters unless you opt in separately.
How long
Account and profile data are kept until you delete your account. Expired sessions and used reset links are removed automatically. Reports are kept as long as needed to handle them.
Public profiles
A published profile is public: anyone can see it, search engines may index it, and others may share or embed it. Only publish what you are allowed to share — Starring shows client names as text and lets you mark work as under NDA, but you are responsible for respecting your contracts.
Statistics
We count page views with a privacy-friendly, cookieless analytics tool (Plausible). It does not use cookies, does not track you across sites and does not store personal data; IP addresses are only used to compute a daily anonymous count.
If you publish a profile, you can see these anonymous counts for your own page in your account: visitors per day, where they came from (e.g. LinkedIn) and their countries. Nobody sees who an individual visitor is.
Owners of a published profile also get these numbers by email once a week. Every email has a one-click unsubscribe link, and you can turn it off in your account.
Statistics chosen by profile owners
A profile owner can connect their own Plausible account to their profile page. When you open such a page, it sends one anonymous page view (the page address and referrer) to the analytics server the owner chose. No script from that server runs on this site and no cookies are set. The owner, not us, is responsible for that analytics account.
Who processes data for us
Hosting of the application and its database, and the email provider used to send account emails, and the analytics service. They process data only on our behalf. Profile pages load fonts from Google Fonts, which receives your IP address when the page loads.
Your rights
You can access, correct, export and delete your data — export your profile from the editor (YAML), and delete everything from Account. You can also object to processing, ask us to restrict it, and complain to your data-protection authority. Contact hello@starring.dev for anything else.