Privacy Policy

Mirrobyte ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data. By using Mirrobyte, you agree to the practices described here.

When you sign in with GitHub, we collect and store the following information:

• GitHub profile data: your username, display name, avatar, bio, location, website, and company
• Repository data: for public repositories: names, descriptions, languages, topics, star counts, links, creation and push dates. For private repositories: only the name, primary language, detected tech stack, creation and push dates, and your commit count (see Section 3)
• Detected tech stack: the names of technologies (e.g. "Next.js", "PostgreSQL") detected from a fixed list of configuration files in your repositories (see Section 3)
• Activity data: commit counts, contribution streaks, commit frequency by hour and day, and pull request counts retrieved via the GitHub API
• Content you create: case studies, professional references submitted by third parties, showcase videos you upload, and custom profile settings
• Authentication data: a GitHub OAuth access token used to fetch your data on demand

We do not collect your GitHub password. Authentication is handled entirely through GitHub's OAuth 2.0 system.

To include your private work in your statistics, Mirrobyte asks GitHub for the repo permission. GitHub displays it as "Full control of private repositories" on the authorization screen, because GitHub does not offer a read-only version of this permission. Here is exactly what we do with it — and what we don't:

• Read-only, always. Mirrobyte never creates, modifies or deletes anything on GitHub — no code, issues, pull requests, settings or repositories.
• We do not read your source code. To detect the technologies a project uses, we read only the following configuration files when they exist: package.json (at the root and in common sub-folders such as frontend/, backend/, apps/web/), requirements.txt, Pipfile, pyproject.toml, setup.cfg, setup.py, Gemfile, go.mod, __manifest__.py, Dockerfile, docker-compose.yml, Helm Chart.yaml, Kubernetes deployment.yaml, Terraform main.tf, and .env.example / .env.sample / .env.template. No other file is ever opened.
• File contents are never stored. These files are processed in memory and immediately discarded; we keep only the resulting technology names.
• Private repository names are hidden by default. Their statistics (commits, languages, tech stack) are counted in your totals without naming the repository. You can choose to display the names in Settings; descriptions, topics and links of private repositories are never stored or shown.
• Private repositories you contributed to (for example, your employer's) are treated the same way.
• Never sent to AI. Private repositories are excluded from everything we send to AI providers.
• Revoke at any time from GitHub → Settings → Applications. Deleting your Mirrobyte account also deletes your access token from our database.

We use your data exclusively to operate the Mirrobyte platform:

• To generate and display your developer portfolio at your public profile URL
• To compute statistics such as total commits, streak length, and language distribution
• To generate AI-powered profile summaries using your repository and activity data
• To display case studies, references, and uploaded media you have created
• To allow you to configure and customize your portfolio settings

We do not sell your data to third parties. We do not use your data for advertising.

Mirrobyte uses a third-party AI service, Groq, to generate profile summaries, project descriptions and FAQ suggestions. For this, the names, languages, tech stacks and descriptions of your public repositories, your public bio and your aggregate statistics may be sent to Groq. Private repositories are never included.

If you choose to import a CV, the text extracted from that PDF is sent to Groq to pre-fill your profile. The PDF itself is not stored.

These providers have their own privacy policies. We do not send personally identifiable information such as your email address to AI providers. AI-generated summaries are stored in our database and displayed only on your profile.

Mirrobyte uses session cookies to keep you signed in. These are set by NextAuth.js and contain a signed, encrypted session token. No tracking or advertising cookies are used.

You can clear session cookies at any time through your browser settings, which will sign you out of the Platform.

Your data is stored in a PostgreSQL database hosted on a private server. Uploaded files (videos and images) are stored on the same server's filesystem. We take reasonable technical measures to protect your data against unauthorized access, including encrypted connections (HTTPS) and access controls.

No method of internet transmission is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any breach that affects your data.

We share your data only in the following limited circumstances:

• Your public profile: Your portfolio, case studies, and references are publicly visible by default at your profile URL
• GitHub API: We communicate with GitHub's API on your behalf using your OAuth token
• AI provider: Public repository metadata, and CV text if you import a CV, is sent to Groq for content generation (see Section 5)
• Legal requirements: We may disclose data if required by law or valid legal process

We do not share your private repository names, commit details, or personal settings with any third party beyond what is described above.

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Update your profile information directly through your GitHub account or platform settings
• Deletion (right to erasure): You can permanently delete your account yourself at any time — go to Settings → scroll to Danger zone → Delete my account. This immediately and permanently removes your profile, all case studies, all references, your GitHub activity snapshot, and your access token. If you cannot access your account, contact us and we will process your deletion request within 30 days.
• Portability: Request your case studies and profile data in a structured format
• AI-generated content: You can replace AI-generated project descriptions with your own text at any time, or contact us to have your AI summary removed

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR). To exercise any of these rights, contact us at the address below.

We retain your data for as long as your account is active. When you delete your account — either through the self-service option in Settings or by contacting us — all personal data including your profile, case studies, references, GitHub activity snapshot, and OAuth access token is permanently and immediately removed from our systems.

Mirrobyte is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.

For any privacy-related questions, data requests, or to exercise your rights, please contact us at farah.kharbech@outlook.com.