privacy

This page lists what ymmv.fyi and its CLI keep about you. It is written from the code, not as a legal policy, and the code is public at github.com/ymmv-fyi/ymmv if you want to check a line.

What the server stores

The database (Cloudflare D1) keeps your data in four tables:

• users: your GitHub account id, your GitHub username as your handle, your extra lines, when you last published (updated_at) and when you first signed in (created_at). Signing in creates this row, even if you never publish.
• profile_entries: the stack values you published, one row per key.
• tokens: one row per sign-in, with a SHA-256 hash of the token, your account id, and when the token was made and revoked. The server stores the hash, never the token.
• handle_history: a handle you stopped using by renaming on GitHub, with your account id and the date. After you rename on GitHub and sign in again, the old address redirects to the new one while your profile is published.

Tokens don't expire. Each one works until its row is revoked or deleted: ymmv logout revokes the one on that machine, signing in again revokes the one it replaces, and ymmv delete deletes every token row on your account, live or revoked. A revoked row stays in the table until ymmv delete deletes it.

What the server doesn't store

• Your GitHub access token. During sign-in the CLI gets one from GitHub and sends it to the server once. The server asks GitHub which account it belongs to, keeps the id and username from the answer, and drops the token. The CLI doesn't save it either.
• Your email address, name or avatar. The server keeps only your account id and username from GitHub's answer.
• Your IP address, browser or referrer. None of them goes into the database or into the server's own log lines.

Sign-in asks GitHub for no OAuth scopes, which limits that GitHub token to read-only access to public information. Neither the CLI nor the server revokes it afterwards. To remove ymmv's access on GitHub's side, revoke it at github.com/settings/applications. That doesn't sign you out of ymmv. ymmv logout signs out the machine you run it on.

Logs and rate limits

The server writes a log line only when a request fails. A few of those lines name the handle or GitHub account id involved, and none contains a token. They go to Cloudflare Workers Logs, which wrangler.jsonc turns on. Workers Logs also keeps its own record of each request, and this code doesn't set what Cloudflare puts in that record or how long it keeps it.

To rate-limit requests, Cloudflare counts sign-ins and the CLI's signed-in calls per IP address, and sign-ins, publishes and deletes per GitHub account id. The counters live in Cloudflare, not in the database.

What is public

Your page at ymmv.fyi/<handle> is public, and so is the same data as JSON at ymmv.fyi/api/v1/u/<handle>, which any website can fetch. Both show your handle, your stack, your extra lines and when you last published. Neither shows your GitHub account id. A diff page, ymmv.fyi/<handle>/vs/<you>, shows your values next to someone else's.

What deleting your profile removes

ymmv delete asks first, unless you pass -y. Then, in one step, it deletes every row that carries your GitHub account id, in all four tables:

• your users row,
• your profile_entries rows,
• your tokens rows, live and revoked, so every machine is signed out,
• your handle_history rows, so an address you renamed away from stops redirecting.

After that, no table holds a row with your GitHub account id. Your page and its JSON answer 404 until you sign in and publish again. Signing in again makes a new users row, the same as a first sign-in.

The delete doesn't reach Cloudflare's backups. Cloudflare keeps point-in-time backups of the database, which it calls Time Travel and describes at developers.cloudflare.com/d1/reference/time-travel. A restore puts the whole database back to a chosen moment, rows deleted since then included. In October 2026 Cloudflare's docs put the limit at 7 days back on the Workers Free plan and 30 days on Workers Paid, so 30 days is the longest a deleted row could come back. Nothing in this code runs a restore. A maintainer would have to run one by hand.

It doesn't reach outside the database either. The server's failure log lines and Cloudflare's rate-limit counters stay as they are. The CLI removes the token.json it signed in with on the machine you run the delete on. Your other machines keep theirs, holding a token that no longer works, and update-check.json and dismissed-marks.json stay on every machine.

Nothing purges a cache on delete. Pages, JSON and rename redirects go out with s-maxage=30, stale-while-revalidate=86400, so a cache that follows those headers can serve the old copy for up to a day. Copies someone already saved are out of the site's reach.

ymmv logout does less. It revokes the token on that machine and deletes the local copy, and your page stays up.

In your browser

The site sets no cookies and loads no analytics or third-party scripts. Its fonts are downloaded when the site is built and served from ymmv.fyi.

The site keeps two keys in localStorage: ymmv-theme, your light or dark choice, and ymmv-you, the last handle you submitted in a diff form. When the home page plays its intro, it sets ymmv-landing-run in sessionStorage so the intro plays once per visit.

On your machine

The CLI keeps three files in ~/.config/ymmv on Linux (or $XDG_CONFIG_HOME/ymmv), ~/Library/Preferences/ymmv on macOS and %APPDATA%\ymmv\Config on Windows:

• token.json: your ymmv token, handle, GitHub account id and the server address. On Linux and macOS only your user can read it (mode 0600).
• update-check.json: when the CLI last checked for a new version, and what it found.
• dismissed-marks.json: detection mismatches you told it to stop pointing out.

Detection runs on your machine and only fills in the preview. A publish sends what the preview showed: your handle, your stack values and your extra lines. In a terminal ymmv asks before it sends, and ymmv -y sends without asking. ymmv set and ymmv unset publish their change right away, with no preview and no confirmation.

Besides ymmv.fyi, the CLI talks to github.com when you sign in. It asks registry.npmjs.org for the latest version once a day, or six hours after a failed check. Set YMMV_NO_UPDATE_CHECK=1 or NO_UPDATE_NOTIFIER=1 to turn that off, and it never runs under CI. ymmv update runs your package manager, which talks to its own registry.

Questions

Ask in a GitHub issue at github.com/ymmv-fyi/ymmv/issues. For anything sensitive, such as a security problem or something you'd rather not post in public, use the private advisory form at github.com/ymmv-fyi/ymmv/security/advisories/new.