Privacy

Graflet is a free, open-source tool. We store the minimum needed to give you the graph you asked for, we measure how the site and the service are used, and — only if you opt in — we email you about new releases. This page says exactly what each of those means and how to stop any of them.

Last updated 26 July 2026.

What we store ourselves

When you sign in with GitHub, we keep one row for your account:

• github_id — your GitHub account id, so we recognize you across sign-ins and the CLI.
• email — the address GitHub returns, used only for transactional and (if opted in) product emails.
• marketing_consent — whether you agreed to product emails. It is tri-state: unset until you answer, then yes or no.
• Three timestamps and nothing more interesting: when you first signed in, when you answered the email question, and whether you answered it on the website or in the CLI.

Two other things exist because you asked for them, and go away with them:

• CLI sign-ins — one row per logged-in machine, holding a hashof that machine's access token and when it was issued. The token itself is never stored, so a copy of our database hands over no live sessions.
• Watched libraries — if you ask the CLI to watch a doc, we store which doc, so we can email you when it is rebuilt. There is no unwatch command yet; email us and we will remove it, and deleting your data below removes them all.

What is stored in your browser

Here is the whole list:

• While you are only browsing — nothing. No analytics cookie, no stored identifier. You are counted, and the count is all that leaves.
• The moment you click “Sign in with GitHub” — one entry, graflet:analytics-anon-id. Signing in sends you to GitHub and back, which loses the anonymous number this visit was counted under; this carries it across so what you did before signing in belongs to you afterwards rather than to nobody. It belongs to that one browser tab, it is deleted as soon as you come back, and it holds nothing but that random number.
• After you sign in — one entry, graflet:session, holding your GitHub handle, your GitHub account id, and your answer to the email question, so you are not asked again. It is not a credential and grants access to nothing; signing out deletes it.
• After you sign in, PostHog also starts keeping its own entries (their names begin ph_) so it can recognise you across visits. That is the difference between an anonymous visitor and an identified person, and signing in is what causes it. Signing out clears them and stops new ones being written.
• If you turn analytics off — one entry, graflet:analytics-opt-out, which is how we remember to keep measurement off.

Analytics: PostHog

We use PostHog to measure how the site and the service are used. PostHog is a processor acting on our instructions, and the data it holds for us is stored in the United States. Analytics requests from this site go to a Graflet subdomain rather than to PostHog directly, so a content blocker may not stop them — the switch below does.

Before you sign in you are anonymous. Visits are counted, but no analytics cookie and no stored identifier are kept for you, and no profile is created. The single exception is the entry listed above that is written when you click sign in, and only then.

Signing in with GitHub makes you an identified person in PostHog, keyed by your github_id, carrying your GitHub login and your email. Those three fields, and nothing else: no avatar, no organisations, no repository names, no access token. From that point your site visits and your graph downloads are one timeline, which is how we can tell whether the thing we built is the thing people use.

What is recorded:

• Pages you visit, where you arrived from, and roughly where you are (country/region, from your IP).
• Clicks and taps, including the text on the button you clicked — never the text you type into a field.
• Catalog searches: the search term itself, lowercased and cut to 64 characters, plus how many results it matched. This is the one piece of typed text we send on purpose, and it is how we learn which libraries to add next — a search that matches nothing is a library we should carry.
• Copying an install command, starting a sign-in, completing one, downloading a graph (or failing to), and asking to watch a library.
• Errors, so we find out something is broken before you have to tell us.

Downloads and sign-ins are recorded by our own server, not by your browser, because most downloads happen in the CLI where there is no browser at all.

Session recording

Sessions on this site may be recorded and replayed as a video: mouse movement, clicks, scrolling, and which pages you moved between. What you type is masked before the recording leaves your browser — form fields come through as blanked-out boxes, so passwords and anything else you enter are never in the video. The only typed text that reaches us is the catalog search term described above, and that arrives as its own event, not from the recording.

What we never do

• We do not sell your data, and we do not share it with anyone for their own marketing.
• The companies that see any of it are processors working for us: PostHog for analytics, Resend for email, and Freemius, who are the merchant of record for supporter licences and take payment details we never see.
• There are no advertising trackers, no ad networks, and no third-party marketing pixels on this site.
• The CLI sends no usage data unless you opt in — see the CLI section. It is off until you answer yes, and it is never on in CI.

One thing the CLI does that is worth knowing anyway: a library's Markdown is downloaded straight from GitHub, as a plain archive from codeload.github.com. We never see that request and it carries no account of yours, but GitHub does see your IP address and which library you asked for — exactly as if you had cloned the repository yourself.

The CLI: off unless you say yes

The first time you run a real command in a terminal, the CLI asks once whether it may send anonymous usage stats. The default is no — a bare Enter is no — and it never asks again. Your answer is stored in ~/.config/graflet/telemetry.json, and graflet telemetry on or graflet telemetry off changes it at any time.

Setting GRAFLET_TELEMETRY=0 or DO_NOT_TRACK=1 disables it entirely, whatever you answered. A run with no terminal attached — CI, a pipe, a cron job — never asks and never sends, because a prompt nobody can answer is not consent.

If you do say yes, four events reach PostHog and nothing else:

• cli_command_run — which subcommand you ran (login, watch, download…) and the graflet version.
• cli_login_completed — that a sign-in finished. No properties.
• cli_download_completed — the library slug, the version it resolved to, how long it took and how many bytes arrived.
• cli_download_failed— one word for why, from a fixed list (“auth_expired”, “not_found”, “transfer_failed”…). Never the error text itself.

Never sent: file paths, file names, your command-line arguments, your hostname, your username, your environment variables, or anything inside what you downloaded. Your IP address is not stored either — the CLI tells PostHog to discard it on every event, which also means no location is derived from it. Before you sign in the events carry a random id generated on your machine and nothing else; signing in attaches them to your github_id, and graflet logout discards both, so the next person to use that machine starts fresh.

The three kinds of email

• Transactional — your download is ready, or a security notice. Sent to everyone; no consent needed.
• Notifications — a doc you asked the CLI to watch was rebuilt. Sent only for docs you chose to watch.
• Product / marketing — a new library or feature. Sent only if marketing_consent = yes. The opt-in box is unticked by default — signing in never enrolls you.

Withdraw consent or unsubscribe

Every product email carries a one-click unsubscribe link and a postal address; clicking it flips your consent to no and stops all product email immediately. You can also stop doc notifications from the CLI at any time.

That consent covers email only. Analytics is a separate thing with its own switch — answering the marketing question either way neither turns analytics on nor off.

Turn analytics off

This switch stops measurement of this site in this browser, right away and on every later visit. It works by remembering one preference on your device, written only once you have asked for it.

It covers the website. Sign-ins and graph downloads are recorded by our server against your account, so if you want those stopped too, delete your account and use the tool signed out. The CLI has its own switch — graflet telemetry off, described above.

Delete your data

The button below deletes your account. You sign in with GitHub first — that is the only way we can tell it is really you, since signing in on this site never gives your browser a password or a token — and then you confirm here. Nothing is deleted until you confirm.

It removes, in one go:

• Your account row: your github_id, your email and your answer to the email question.
• Every machine you are logged in on, so no CLI can keep using a token that belonged to you.
• Every library you asked the CLI to watch.
• The person PostHog holds for us, together with your events and any session recordings. PostHog removes the profile immediately and queues the events and recordings, which they clear outside peak hours.

If either half fails, the whole thing fails and tells you so — we would rather you retry than be told you were erased when half of you was still there. Prefer to ask a human, or want a copy of what we hold first? Email graflet@rnui.dev or open an issue in the repository.

The code

Everything here is verifiable — the storage, the consent handling and every analytics call are open source. Read it in the repository.