rererepo
Legal

rererepo Privacy Policy

Effective: September 5, 2026 (first edition)

This is a convenience translation. The Japanese version is the governing text and prevails in case of any discrepancy (section 9).

1. Principles

rererepo (the "Software") is a local-only desktop app. The developer (GitHub account lightsound) operates no server or database for the Software and does not collect, transmit or store your account information, repository contents, activity or usage. Everything the Software handles stays between your Mac and your own GitHub account.

2. Information handled by the Software and where it is stored

All of the following is stored only on your Mac and is never sent to the developer.

Information Location Purpose
GitHub access token macOS Keychain only (service name com.rererepo.app). Never written to files, databases or logs Calling the GitHub API
Repository metadata fetched from GitHub (name, last push date, star count, archived state, permissions, etc.) and your login name and organization list ~/.config/rererepo/cache.db (a disposable cache; deleting it triggers a refetch on the next launch) Listing and deciding cleanup targets
Paths and state of local Git repositories (e.g. whether there are uncommitted or unpushed changes) In memory and in the same cache Detecting local clones, warnings before deletion, organizing (moving)
App settings (thresholds, scan folders, editor, shortcut, language, etc.) ~/.config/rererepo/settings.json (plain text; you can carry it between machines freely) Persisting your settings
History of repositories "opened" from the quick launcher (count and last used time) The same cache (cache.db) Ranking launcher search results (frequently used first). Never used to decide cleanup targets
Log of organize (move) operations ~/.config/rererepo/organize-journal.jsonl The "Undo" action

The local scan covers your home folder by default; folders protected by macOS (Desktop, Downloads, Documents) are included only when you explicitly allow it. The scan reads the presence of Git repositories and Git metadata — it does not read the contents of your source code.

3. Network communication (complete list)

The Software communicates with exactly the following three kinds of endpoints. There are no others.

Endpoint What Information sent
GitHub (github.com / api.github.com) Sign-in (OAuth device flow), fetching your repository and star lists, creating and deleting repositories. Git operations such as clone and push are performed through your own git command, whose endpoints and authentication follow your Git configuration The access token and the content of the operations you request (e.g. the name of a repository to create, the deletion target)
GitHub avatar images (github.com/<login>.png — redirects to avatars.githubusercontent.com, which serves the image bytes) Fetching the icons of users and organizations shown in the list The login name being displayed (as part of the URL). No token is sent
Update feed (dl.rererepo.com) Checking for a new version at launch and roughly every 24 hours (update.json), and downloading the distribution (signed manifest, app bundle, DMG) when you choose to update Ordinary HTTP requests only. No account information, identifiers or usage data

The update feed is served from Cloudflare storage (R2); Cloudflare's standard delivery logs (IP address, time, file name requested) may be recorded temporarily on Cloudflare's side. The developer does not use those logs to identify or profile users. Their handling is governed by the Cloudflare Privacy Policy. Information exchanged with GitHub is governed by the GitHub Privacy Statement.

4. Telemetry, crash reports and advertising

The Software performs none of the following: usage measurement (telemetry / analytics), automatic crash reporting, advertising, or tracking. Should any of these be introduced in the future, they will be off by default (opt-in) and this policy will be revised and announced in advance.

5. About the GitHub access token

  1. At sign-in the Software requests the following scopes (permissions) from GitHub:
    • repo — listing repositories including private ones, reading their metadata, and creating repositories
    • delete_repo — deleting repositories that you explicitly instruct the Software to delete
    • read:org — listing the organizations you can choose as an owner when creating a repository
  2. The token is stored only in the macOS Keychain and is never written out to other processes or files. The developer never receives it.
  3. "Sign out" inside the app removes the token from the Keychain. You can revoke the authorization on GitHub's side at any time under Settings → Applications → Authorized OAuth Apps.

6. Deleting your data

Because everything the Software stores lives on your Mac, you can delete it yourself: sign out in the app, delete the ~/.config/rererepo/ folder, and revoke the GitHub authorization if you wish. If you installed with Homebrew, brew uninstall --zap --cask rererepo removes those configuration files as well.

7. About this website (rererepo.com)

rererepo.com is a static website. It sets no cookies and loads no analytics or advertising scripts. Cloudflare Pages, which serves the site, may record its standard access logs.

8. Contact

Questions about this policy: GitHub Issues on the public repository (handled on a best-effort basis).

9. Revisions

This policy may be revised as features or laws change. A revised policy takes effect when posted on this page. Material changes, such as new network endpoints, will also be announced in the release notes. The Japanese text is the authoritative version; in case of any discrepancy the Japanese version prevails.

Date Change
2026-09-05 First edition (published alongside v0.1.10, the first release after rererepo became free)