This page explains what personal data awesome-repositories.com collects when you visit the site, search it, sign in, connect an AI assistant to it, or submit a repository, why we collect it, and what we do with it. It is our privacy notice under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Romanian Law 190/2018. It covers every endpoint we run: the public directory, search, sign-in, the MCP server for AI assistants, the submission and feedback forms, and the admin pages.
Data controller
The controller of your personal data is:
- Bringes Technology SRL
- Str. Crișului nr. 14 Bis, Oraș Băicoi, Jud. Prahova, Romania
- VAT: RO45896025
- Contact: hello@awesome-repositories.com
We have not appointed a Data Protection Officer. For any privacy matter, write to the address above.
Data we collect
- Account (optional). You can browse and search without an account. If you sign in, on the site or while connecting an AI assistant (see below), you do so with Google; anyone with a Google account can sign in. Google sends us your name, email address, profile picture, and Google account id, and we store them together with the sign-in tokens Google issues. Each time you sign in we create a session record that holds your IP address and browser user-agent. A session expires after 7 days unless you keep using it. While you are signed in, the searches, votes, feedback, and submissions you make are linked to your account.
- Connected AI assistants (MCP). Our MCP server (/api/mcp) lets AI assistants such as Claude search the directory on your behalf. To connect one, you sign in with Google and approve it on a consent screen. We then store the assistant's registration (the client name, website, logo, and callback addresses it gives us), your approval and the permissions you granted, and the access and refresh tokens issued to it. Access tokens expire after 1 hour and refresh tokens after 30 days; both are stored hashed. The MCP tools only read the public directory. We do not log the tool calls or the search text that arrives over MCP, but that text is sent to Voyage AI to compute the search (see "Search queries").
- Submitted repository metadata. When you paste a GitHub URL into Submit a repository we fetch the repo's public metadata and README from the GitHub API and store a copy in our database. With the submission we store the email address you enter, your IP address and a salted hash of it, your browser user-agent, your anonymous visitor id, and your account id if you are signed in.
- Directory listings. Display name (owner/repo), description, stars, language, topics, moderation status, views, upvotes, and downvotes are stored in our database. These describe public GitHub repositories, not visitors.
- Votes and result ratings. When you vote on a repository or rate a search result, we store the vote with your IP address, a salted SHA-256 hash of your IP address (used to allow one vote per visitor), your anonymous visitor id, and your account id if you are signed in.
- Views. Every visit to a repository page increments a counter on that repository; the counter itself holds no visitor identity. Page views are also recorded as described under "Visit and click logs" and "Analytics (PostHog)".
- Visit and click logs. For each page you open and each outbound link you click (for example to a repository on GitHub), our servers record the page or link, the referring page, your browser user-agent, and your country (as reported by Cloudflare). Until you accept cookies, the record carries only an anonymous id that changes every day: a hash of your IP address and user-agent with a random salt that is deleted after the day, so it cannot be linked to you or across days. No IP address, visitor cookie, or account id is stored with it. After you accept, the record also holds your IP address and a salted hash of it, your anonymous visitor id, and your account id if you are signed in. Admins use these logs to see how the site is used and to tell people from bots. Clicks we classify as bots are not stored.
- Search queries. The text you type into the search box is saved with the filters you chose, the results and AI scores it produced, your IP address and a salted hash of it, your anonymous visitor id, and your account id if you are signed in. The saved results are reused to answer the same search for later visitors. To run a search, the query text is sent to Voyage AI, which turns it into a numeric vector, and on the website (not over MCP) also to large language models through OpenRouter, which rank the results. When live web lookups are enabled, OpenRouter passes the query to its web-search provider (Exa). We also count your searches per day, by account or by IP hash, to apply daily search limits.
- Feedback. If you submit feedback, we store the message, the optional email you provide, the page you sent it from, your browser user-agent, your IP address and a salted hash of it, your anonymous visitor id, and your account id if you are signed in.
- Admin accounts. Admins sign in the same way as everyone else. Admin rights come from a list of email addresses in our server configuration, not from anything stored about you.
- GitHub avatars. Repository owner avatars load directly from GitHub's image servers (avatars.githubusercontent.com), so GitHub receives your IP address and browser user-agent when you view a page that shows them.
- Analytics (PostHog). We use PostHog (EU region). Until you accept cookies, PostHog runs in its cookieless mode: the browser counts only the pages you open and leave, stores nothing on your device, and builds no profile. Our servers then send PostHog repository views, votes, outbound link clicks, feedback and submission events (without the message, email, or any id), and search-result ratings in the same cookieless form. PostHog uses your IP address and user-agent only to compute a hash with a salt it rotates daily, and does not store the IP. After you accept, PostHog also records clicks on interactive elements (not on touch devices), session recordings, and errors on the page, keeps an anonymous visitor id in a first-party cookie and local storage, and the server events carry your anonymous visitor id, IP address, user-agent, the feedback message and email you give, and your account id if you are signed in. Requests we classify as bots are not sent. Our servers send PostHog reports of server errors for everyone; without your consent they carry no visitor or account id.
- Analytics (Google Analytics 4). We load Google Analytics 4 via the gtag.js tag only after you accept cookies; before that, nothing from Google Analytics loads. When you accept, we set analytics and advertising consent (analytics_storage, ad_storage, ad_user_data, ad_personalization) to granted, and Google Analytics uses first-party cookies (the _ga family) to distinguish visitors.
- Product analytics (Microsoft Clarity). We use Microsoft Clarity for heatmaps and session replays (a playback of mouse movement, clicks, and scrolling). Microsoft receives your IP address, user-agent, the pages you view, and these interaction events, and sets first-party cookies (_clck / _clsk) to keep an anonymous visitor id. Clarity loads only after you accept cookies.
Why we collect it and on what legal basis
We process personal data under the following Article 6 GDPR bases:
- Performance of a service (Art. 6(1)(b)): running your account and your sign-in sessions, connecting the AI assistants you authorise, running your searches, and hosting, serving, and moderating submitted repositories.
- Legitimate interests (Art. 6(1)(f)): allowing one vote per visitor, applying daily search limits, counting page views, keeping visit, click, and search logs to improve the product and tell people from bots, counting visits anonymously (with PostHog's cookieless mode and our own daily-rotating id) before you make a cookie choice, and sending server error reports to PostHog.
- Consent (Art. 6(1)(a)): PostHog with cookies and identifiers (in the browser and in the events our servers send), Google Analytics, and Microsoft Clarity. You give consent with the cookie banner. To withdraw it, delete the cc cookie in your browser: Google Analytics and Clarity no longer load, and PostHog and our logs return to the anonymous counting described above.
Who can see what
- Public: anything in an approved repository listing (owner/repo, description, cached README, topics, view and vote counts).
- Admins only: accounts and their activity, pending and rejected submissions, feedback messages, search logs, visit and click logs.
- Processors and sub-processors: The site, its database, and the cluster it runs on are hosted on our own servers in Europe, operated by Bringes Technology SRL; no cloud provider hosts the application. We use Hetzner Online GmbH (Germany: storage of database backups and site files), Cloudflare, Inc. (DNS, content delivery and proxying of all traffic), Google Ireland Limited (sign-in, Google Analytics), PostHog (EU region: analytics and error reports), Microsoft Corporation (Microsoft Clarity: heatmaps and session replay), Voyage AI (turning search text into vectors), OpenRouter, Inc. (routing search text to the large language models that rank results, and to its web-search provider Exa when web lookups are on), and GitHub, Inc. (public repository metadata, owner avatars).
International transfers
Our own servers, database, and backups are in the European Economic Area, and PostHog runs in its EU region. Cloudflare, Google, and Microsoft may process your IP address and request metadata outside the EEA. The text of your searches goes to Voyage AI, OpenRouter, the model providers OpenRouter selects, and Exa, which are based mainly in the United States.
Retention
- Approved repository listings: kept until an admin removes them.
- Accounts and connected assistants: not deleted automatically. Sessions expire after 7 days unless used, access tokens after 1 hour, and refresh tokens after 30 days; the expired records stay in the database.
- Submissions, votes, result ratings, and feedback messages: not deleted automatically.
- Search logs: not deleted, because the saved results answer the same search for later visitors. The IP address, IP hash, visitor id, and account id saved with a search, and any debugging traces attached to it, are kept with it.
- Visit and click logs: not deleted automatically.
- Daily search-limit counters: not deleted automatically; each holds only a timestamp, an IP hash, and an account id.
- PostHog, Google Analytics, and Microsoft Clarity data: kept by each provider under its own retention settings.
Your rights under the GDPR
Under the GDPR you have the right to:
- Access the data we hold about you (Art. 15).
- Rectify data that is inaccurate or incomplete (Art. 16).
- Erase data ("right to be forgotten", Art. 17).
- Restrict processing in certain circumstances (Art. 18).
- Data portability — receive the data you gave us in a machine-readable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent you have given for analytics at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
- Lodge a complaint with a supervisory authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, București, dataprotection.ro. You may also complain to the authority in your EU country of residence.
To exercise any of these rights, email hello@awesome-repositories.com.
Automated decisions
We do not use your personal data to make automated decisions with legal or similarly significant effects on you.
Security
The site is served over HTTPS. Sign-in uses Google OAuth, and the sign-in and visitor-id cookies are HttpOnly and SameSite=Lax. Tokens issued to AI assistants are stored hashed and expire (1 hour for access tokens, 30 days for refresh tokens). Admin pages are limited to a configured list of email addresses. API keys and other secrets are kept in server configuration, not in the code.
Cookies & local storage
We use a small number of cookies and storage entries, in two groups:
- Strictly necessary (no consent required): the sign-in session cookies (first-party, HttpOnly, set only when you sign in), a did cookie (first-party, HttpOnly, 1 year) that stores an anonymous visitor id for your saved searches and for protecting the AI search from automated abuse (it is used for analytics only after you accept cookies), the cc cookie (1 year) that remembers your cookie-banner choice, and session-storage entries the site uses within a tab, for example to avoid counting the same page view twice.
- Analytics (require your consent): PostHog's cookie and local-storage entry for an anonymous visitor id, the Google Analytics _ga family of cookies, and Microsoft Clarity's _clck / _clsk cookies. These are set only after you click Accept in the cookie banner.
You can withdraw analytics consent at any time by deleting the cc cookie or by blocking analytics scripts in your browser.
Changes
The date at the top of this page shows when it last changed.
Contact
Bringes Technology SRL, Str. Crișului nr. 14 Bis, Oraș Băicoi, Jud. Prahova, Romania — VAT RO45896025. Questions, takedown requests, or corrections: hello@awesome-repositories.com.