Privacy policy

This policy explains which personal data RepoPicks Radar (repopicks.com) processes, why, who it is shared with and how you can exercise your rights. It follows Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018) and, for people who visit the site from the European Economic Area, the United Kingdom or Switzerland, also the data protection rules of those places, such as the GDPR.

In short: the site does not ask you to sign up or log in, does not set tracking cookies of its own and never sells data. Google ads use cookies and identifiers: in Europe, the United Kingdom and Switzerland, they are set only after you choose; elsewhere, you choose whether the ads can be personalized. The only personal data you give us directly is what is in the emails you write to us.

Who is responsible

The party responsible for processing the data (the controller, in LGPD terms) is Renato Oliveira, a natural person living in Brazil, who runs RepoPicks Radar independently.

For anything about your data, including exercising the rights described below, write to repopicks@repopicks.com. This is our channel for communicating with data subjects. Because RepoPicks is a small processing agent (Resolution CD/ANPD No. 2/2022), it has not appointed a data protection officer.

What data we collect

You can use the site without giving any personal data. The data processed is the following:

• Emails you send us. If you write to repopicks@repopicks.com, for example to ask for a card to be corrected, we receive your email address, your name, if you give it, and the content of the message. The email goes through Cloudflare Email Routing and reaches a Gmail mailbox.
• Public data of project authors. The cards are about public GitHub projects and may mention data that the author made public, such as the username, the date the account was created and the repository data.
• Technical access data. As on any website, your browser has to request the pages from a server. Cloudflare, which hosts the site, processes technical data from these requests, such as the IP address, the type of browser and device, the page requested, the date and the time, to deliver the pages and protect the site against abuse and attacks. Cloudflare also tells the site which country the request comes from, so that it can show the right cookie notice for where you are; the site does not store this information.
• Visit statistics. Statistics use Cloudflare Web Analytics, which does not set cookies or identifiers in your browser and shows only aggregate numbers, such as how many visits each page had, from which countries and on which kinds of device.
• Google ads. The site uses Google AdSense. Google and Google’s partners may set and read cookies and identifiers in your browser and receive data such as the IP address and the pages visited, as explained in the section “Google ads and cookies”.
• Preferences in your browser. The theme (light or dark), the panels and tabs you open or close and your choice about ads are kept only in your browser’s local storage (localStorage). These preferences are not sent to us, and you can delete them by clearing the site’s data in your browser.

We do not ask for sensitive data, such as health data, religion or political opinions, or for documents. Please do not include them in your messages.

What we use it for and on what legal basis

Each use has a legal basis under the LGPD (art. 7):

• Consent (art. 7, I). To show personalized ads, when you choose that option and, in Europe, the United Kingdom and Switzerland, for any ad cookie or identifier. You can withdraw your consent at any time, as easily as you gave it, through the “Cookie preferences” link in the site footer; withdrawal does not affect what was done before it.
• Legitimate interest (art. 7, IX). To deliver the pages, protect the site against abuse and attacks, measure visits in aggregate numbers and without cookies, answer the emails you send us, publish information about public GitHub projects, including the public data of their authors, and, outside Europe, the United Kingdom and Switzerland, show non-personalized ads, which help keep the site free. We use only the minimum needed for this, and you can object to this use through the contact email.

The emails you send us are used only to reply. If a correction request leads to a change on a card, your name and your email are not published. People who appear on a card can ask for their data to be corrected, objected to or removed through the contact email.

We do not use your data to build a profile of you or to make automated decisions about you. Ad personalization is done by Google, and only when you allow it.

For people in the European Economic Area, the United Kingdom or Switzerland, the equivalent GDPR legal bases are consent (art. 6(1)(a)) and legitimate interest (art. 6(1)(f)). In those places, ad cookies and identifiers always depend on your consent, under local cookie rules.

Google ads and cookies

The site shows Google AdSense ads. Google and its partners use cookies and identifiers to show ads, including based on your previous visits to this and other websites. For this, Google decides how it uses this data, as an independent controller, in accordance with the Google Privacy Policy. To learn more, see how Google uses data from sites and apps that use its services.

Even non-personalized ads use cookies or identifiers, to limit how many times an ad is shown, measure results in aggregate numbers and fight abuse. The difference is that they are chosen based on the content of the page and your approximate location, and not on your browsing history.

European Economic Area, United Kingdom and Switzerland. For people visiting from these places, consent is requested through Google’s consent message, a consent platform certified by Google. No ad cookie or identifier is set before you choose, and refusing is as easy as accepting. If you refuse, Google may show limited ads, without cookies, or no ads at all. To change your choice later, use the “Cookie preferences” link in the site footer.

Other countries. A notice at the bottom of the page asks whether ads can be personalized. Until you choose, or if you choose only non-personalized ads, ads are shown as non-personalized. To change your choice at any time, use the “Cookie preferences” link in the site footer. Your choice is kept only in your browser.

United States. For people who live in US states with their own privacy laws, Google shows a message where you can refuse the use of your data for personalized ads. The site does not change how it works because of the browser’s “Do Not Track” signal.

Your choices also apply outside the site:

• In your Google account. You can turn off the personalization of Google ads in My Ad Center.
• With other ad companies. You can opt out of the use of cookies for personalized ads by participating companies at aboutads.info.
• In your browser. You can block or delete cookies in your browser settings; the site keeps working without them.

Cookies and similar technologies

This table shows what may be stored in your browser when you use the site:

Who we share it with

We do not sell, rent or trade personal data. We share only what is needed with the services that make the site work:

• Cloudflare, which hosts the site, delivers the pages, protects against abuse and attacks, produces the visit statistics and forwards the emails sent to repopicks@repopicks.com.
• Google, which provides the ads (AdSense) and the mailbox (Gmail) where we receive and answer messages.

Cloudflare processes the data on our behalf, as a processor, for the purposes in this policy. Google processes the data under its own rules: for ads, as an independent controller; for Gmail, under the terms of the email service.

When the site gets forms, the service that receives them will appear in this list, and the date of this policy will change.

We may also have to disclose data to a public authority when the law or a court order requires it.

Links to GitHub and to other sites lead to pages that are not ours and that have their own privacy rules.

International transfers

Cloudflare and Google operate in several countries, and part of the processing takes place on servers outside Brazil, for example in the United States. For this reason, your data may be transferred to other countries.

These transfers rely on the mechanisms provided in article 33 of the LGPD, such as the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) or another guarantee that each service adopts. For people in Europe, GDPR mechanisms also apply, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. You can ask for information about these guarantees through the contact email.

How long we keep it

• Emails you send us, including correction requests: up to 12 months after our answer, in case the matter comes up again.
• Technical access data and Cloudflare and Google cookies: for the periods set by them in their policies.
• Preferences in your browser: they stay on your device until you clear the site’s data.

After these periods, the data is deleted or anonymized, unless the law allows or requires us to keep it longer, for example to meet a legal obligation or to defend rights in legal proceedings.

While we keep the data, we take reasonable technical and administrative measures to protect it, such as restricted access and encrypted connections (HTTPS). No system on the internet is free of failures, and we do not guarantee the absence of risks. If a security incident happens that may bring you relevant risk or harm, we will inform you and the ANPD within the deadlines set by law.

Your rights

Under the LGPD (art. 18), you can ask at any time for:

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• portability of your data to another provider;
• deletion of the data processed with your consent;
• information about who we share your data with;
• information about the possibility of not giving consent and about what happens if you do not give it;
• withdrawal of your consent.

You can also object to processing based on legitimate interest if you believe it does not comply with the law.

To make a request, write to repopicks@repopicks.com. We may ask you to confirm that the request is yours, so that we do not hand data over to someone else. Requests are free of charge, and we answer within the deadline set by law: under the LGPD, within 15 days.

If you believe your request was not met, you can file a complaint with Brazil’s National Data Protection Authority (ANPD). People in the European Economic Area, the United Kingdom or Switzerland have the equivalent GDPR rights, which also include asking to restrict processing and getting an answer within 1 month, and they can complain to the data protection authority of their country.

Children

RepoPicks Radar is not directed at children or teenagers and does not knowingly collect data from people under 18. We ask that people under 18 not accept personalized ads. If you are a parent or guardian and believe a minor has sent us data, write to repopicks@repopicks.com, and we will delete it.

Changes to this policy

This policy may change when the site changes, for example when the forms or the app start working, or when the law requires it. The version in force is always the one on this page, with the date of the last update at the end. If a change is important, we will highlight it on the site.

This policy exists in Portuguese, English, Spanish and Chinese. All versions carry the same weight in explaining how your data is processed; if they differ, the one more favorable to you prevails.

Last updated: October 31, 2026