Privacy

ActionRank is a free, independently run directory. It has no accounts, no ads, and no tracking. The only personal data it holds is an email address, and only if you explicitly asked for alerts.

Last updated August 3, 2026

What we collect

Browsing the site — reading action pages, categories, rankings, research or using the SHA pin generator — requires nothing from you and stores nothing about you. There are three, and only three, places where you can hand us data:

• Alert subscriptions. Your email address and which action you asked about. We use it for one purpose: emailing you if that action becomes abandoned or a new security advisory is published. Nothing is sent until you click the confirmation link, and every alert carries a one-click unsubscribe.
• Submitting an action or reporting a data issue. The repository you name, your message, and your email address if you choose to give one (it is optional on both forms). Please don’t put anything sensitive in the free-text box — it is stored as written.
• Abuse prevention. When you submit the subscribe form we count recent submissions so the form can’t be used to mailbomb someone. We store a salted SHA-256 hash of your IP address and of the email address — never the values themselves — together with a counter. These rows are deleted automatically after seven days.

What we don’t do

No cookies. No localStorage. No analytics, pixels, tag managers or session recording. No advertising network. No profile of you is built, and nothing is sold or shared for marketing. Fonts are self-hosted at build time, so your browser makes no request to Google or any other third party while you read this page.

The SHA pin generator sends the workflow text you paste to our server so it can be parsed, then discards it. It is never written to a database and never logged.

Where it is stored, and who processes it

• Database. A self-hosted PostgreSQL instance on a private server in Ashburn, Virginia, United States. It is not shared with any other party.
• Hosting. Vercel serves the website and, like any web host, processes request metadata such as IP addresses in its own operational logs.
• Email delivery. Resend (United States) delivers alert and confirmation emails and therefore receives the recipient address and message content.

That is the complete list. The data sources behind our scores — the GitHub API, OpenSSF Scorecard and OSV.dev — are read-only. We send them nothing about you.

If you are in the EU, UK or elsewhere outside the United States, note that using the site means your data is processed in the US.

How long we keep it

• Abuse-prevention hashes: deleted automatically after 7 days.
• Alert subscriptions: kept while the subscription exists. Unsubscribing stops all email immediately and marks the record inactive; ask us and we will delete it outright.
• Submissions and issue reports: kept while we act on them, then deleted on request.

Your rights, and how to use them

You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Under the GDPR our lawful basis for alert emails is your consent, which you can withdraw at any time — the unsubscribe link in every email does exactly that, with no need to contact anyone.

For anything else, use the contact form and say what you want done. It reaches the person who runs the site. We aim to reply within a few days; ActionRank is run by one person, so please allow for that. If you email us from the address in question we can act on it directly, and we won’t ask for identity documents to delete an email address.

Data we publish about maintainers

ActionRank profiles public GitHub repositories. Those pages show information GitHub already publishes — repository names, owner account names, commit and release dates, licences, public security advisories — together with scores we compute from it. We do not collect maintainers’ contact details or any private information.

If you maintain an action and believe something we publish about it is wrong or unfair, the report form goes straight to us, and our methodology page documents exactly how each figure is derived.

Security

Traffic is encrypted in transit. Subscriber records can only be read by the site’s own backend — the public API key the website ships with cannot read them. Confirmation and unsubscribe links contain a random 48-character token that acts as the key to that one subscription, so treat those links as private. No system is perfect, and we make no guarantee that ours is.

Changes

If this policy changes materially we will update the date at the top. If a change affects how we use email addresses already collected, we will email affected subscribers before it takes effect rather than relying on you to re-read this page.

ActionRank is an independent project and is not affiliated with, endorsed by, or sponsored by GitHub, Inc.