Privacy Policy

Who runs Fuel

Fuel is run by its maintainers. For any privacy question or request, use the channels on the Contact page.

Signing in with GitHub

Fuel has no passwords: you sign in with GitHub (OAuth). When you do, GitHub shares your public profile — username, display name, avatar, bio and website — and your email address (OAuth scopes read:user and user:email).

Fuel cannot see your private repositories, cannot write anything to GitHub and never receives your GitHub password. Your sign-in email is used for your account and is not shown on your public profile.

When you import a tool from GitHub, Fuel reads that repository's public information (name, description, README, topics, stars) through GitHub's public API.

What you publish

Fuel stores what you add so the service can show it: your profile, the tools you list, ideas, comments, upvotes, follows, team-up posts and applications, payout links and thank-you notes.

Most of this is public by design (profiles, tools, ideas, comments, payout links, public thank-you notes). Team-up contact details you add (such as an email address or Discord name) are shown according to the visibility you choose, and applications are shown to the team's owner.

Cookies

A session cookie set by our sign-in library (NextAuth) keeps you signed in for up to 30 days; short-lived security cookies (CSRF protection, OAuth state) are set while you sign in.

The fuel_lang cookie remembers the language you picked, for one year.

Fuel does not use advertising cookies, third-party trackers or cross-site analytics.

Anonymous page statistics

To show creators how their pages do, Fuel counts views, copy actions and outbound clicks on tool, project and profile pages. This uses no cookies.

Your IP address is never stored. It is used only in the moment to compute a salted, one-way hash that changes every day (so a repeat visit is counted once) and to look up an approximate country, which our host provides. The referring page is reduced to a coarse source such as “GitHub”, “search” or “direct”; the full referrer URL is not stored.

If your browser sends Do Not Track or Global Privacy Control, the visit is not recorded. Known bots and link previews are ignored.

Raw events are deleted after 180 days; after that only aggregated daily counts remain.

Tip clicks and thank-you notes

Clicks on payout links are counted for creators' stats and the leaderboard. To de-duplicate them and prevent abuse, Fuel stores a salted hash of your IP address and browser user-agent — never the IP itself.

When you leave a thank-you note, Fuel stores the name and message you enter and a salted hash of your IP address for rate limiting. Notes are self-reported and are not verified.

Money

Fuel never processes, receives or holds money. Supporters pay creators directly through the creators' own payment links (for example PayPal, GitHub Sponsors, Ko-fi or Buy Me a Coffee). Those services handle your payment details under their own privacy policies; Fuel never sees them.

Service providers

Fuel is hosted on Vercel and its database runs on Supabase (PostgreSQL). GitHub provides sign-in and public repository data. If Fuel sends you email (for example account or notification email), it goes through an email delivery provider. The community lives on Discord, under Discord's own terms and privacy policy.

We don't sell personal data and don't share it with advertisers.

Keeping and deleting data

Account data is kept while your account exists. You can ask for your account and the content you posted to be deleted — see the Contact page. We will confirm that the request comes from the account owner first.

Copies may remain for a short time in backups and in caches outside our control (for example GitHub's image cache for README badges).

Changes

When the way Fuel handles data changes, we update this page and the date at the top.