Privacy Policy

Last updated: August 17, 2026

Forkfolio is a portfolio platform for developers: you sign in with GitHub, we build a live portfolio from your public GitHub data, and an AI assistant on your page answers visitor questions about your work. This policy explains what we collect, where it goes, and the control you have over it. Forkfolio is operated by Louey Lahwel; reach us any time at forkfolioteam@forkfolio.dev.

What we collect

• GitHub account data, via GitHub OAuth: your username, display name, avatar, and email address.
• Repository metadata: names, descriptions, languages, topics, stars, and activity of your public repositories. If you grant private access, we read private repository metadata only (never source code) to detect languages for your skills list; private repos are never shown on your public portfolio.
• Content you add: bio, title, experiences, certifications, skills, social links, profile picture, and your résumé if you upload one.
• Messages sent to you through your portfolio's contact form, and feedback you send us from your dashboard.
• A view counter per portfolio. We do not run analytics trackers, ad pixels, or fingerprinting.
• Subscription status, for Pro customers: plan, billing interval, and renewal date. We never see or store your card details - Polar (below) handles payment directly.

GitHub permissions we request

At sign-in, GitHub shows these OAuth scopes:

• read:user and user:email: read your profile and email, used to create your account.
• repo: only if you choose to include your private work, from your dashboard. Signing in does not ask for it. GitHub has no read-only permission for private repositories, so its consent screen says read and write - Forkfolio never writes to GitHub, and uses this only to read repository metadata and languages. You can withdraw it at any time from your dashboard or your GitHub settings.

You can revoke Forkfolio's access any time in your GitHub settings (Settings → Applications → Authorized OAuth Apps). To also remove your stored data, delete your account first (see below).

How the AI assistant handles data

Each portfolio can show a chat assistant that answers questions about that developer. To do that:

• Portfolio content (profile, repo READMEs, résumé if uploaded) is chunked and converted to numerical embeddings using Google Gemini and/or OpenAI embedding models, stored in our database.
• A visitor's question, plus the most relevant portfolio chunks, is sent to Groq (our chat model provider) to generate an answer.
• Conversations are not stored or logged on our servers. Chat history lives only in the visitor's browser tab and is sent along with each question to keep context; it disappears when the tab closes.

Who processes your data

• GitHub: sign-in and repository data (their own platform).
• Supabase: database and authentication hosting.
• Vercel: website hosting and content delivery.
• Groq: chat answers for the AI assistant.
• Google / OpenAI: text embeddings for the AI assistant.
• Polar: payment processing and billing for Pro subscriptions, as merchant of record. See their own privacy policy.

We do not sell your data, share it with advertisers, or use it to train models.

What is public

Your portfolio page is public by design: your name, title, bio, public repositories, skills, experiences, and social links are visible to anyone with the link, and your AI assistant answers questions from that same public material. Contact-form messages and your dashboard data stay private to you.

Cookies

We use only the cookies required to keep you signed in. There are no advertising, tracking, or third-party analytics cookies.

Deleting your account

You can delete your account at any time from your dashboard (Danger zone, at the bottom). Deletion removes your profile, portfolio data, résumé, AI assistant knowledge, messages, feedback, and your stored GitHub access token, and detaches any custom domain and your forkfolio.dev subdomain. This is immediate and permanent. Afterwards, also revoke Forkfolio in your GitHub settings to fully close the loop.

Data retention

We keep your data while your account exists. Synced GitHub data is refreshed continuously; deleted accounts leave no retained copies beyond ordinary database backups, which rotate out on the provider's schedule.

Security

Access tokens and AI keys are stored server-side only and never exposed to the browser. Traffic is encrypted (HTTPS) end to end. No system is perfectly secure; if we ever become aware of a breach affecting your data, we will notify you by email.

Children

Forkfolio is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes materially, we will note the new date here and, for significant changes, announce it on the site before it takes effect.

Contact

Questions, requests, or deletion help: forkfolioteam@forkfolio.dev. Also see our Terms of Service.