What the site stores
This table names every field, not a summary of them. Where a row lists many fields, that is the whole list for that row.
| field | why | kept for |
|---|---|---|
| the day cache for a scanned repository: its owner and name, the creation and last-push times, the star and fork counts, the primary language, the fork, archive and lock flags, the default branch name, and every commit timestamp in the read window | so a rescan within a day costs no API budget. all of it is public data. | 24 hours |
| a salted hash of each commit author identity | counting distinct authors. only the count is used. | 24 hours |
| one result: the predicted date and day count, whether it came from the model or the base rate and why, the six measurements and the six transformed features, the repository path, the language, the creation date, the scan time, the salted repository hash, the model version, and whether the fit behind it was a placeholder | so the result page can be reopened, shared, and read the same way later | 13 months |
| a salted hash of the repository path | the weekly percentile set, so a rescan replaces its own row | 5 weeks |
| aggregate counters: scans, horizons, a month histogram | the numbers page | up to 3 years |
| a board: its title, its members' display names and dates | the death-board | 13 months |
one cookie, wmpd_mine, holding result ids | so your own result page can show your repository name | 30 days |
What the site never stores
- An address. Not yours, and not a hashed one.
- A raw author email. The salt is applied before anything is written.
- An account, a login, or a credential. There are no accounts. A death-board does store the display names its members type, and a wager stores the display name of whoever made it.
- A user agent, a referrer, or a session identifier for analytics.
- Anything at all about a visitor who only reads a page.
What never appears on a shared page
A visitor can scan a repository they do not own. So a repository path renders in one place only: on the result page, for the browser that ran the scan, proved by the wmpd_mine cookie. A board carries display names its members chose. The badge names a repository, and only because embedding it is the owner's own act.
GitHub
The site reads public repository data through GitHub's API, from the server. Your browser never calls GitHub. The site never contacts a repository owner, never tags anyone, and never posts anything to GitHub.
Removal
The takedown route removes a repository from the percentile set and clears its cached data and its badge. It works without an account and without a reason.