What is stored, what is not

A claim writes domains/<name>.json to a public GitHub repository: the name, your GitHub login, the claim timestamp, any DNS records you set, and an optional display profile. Git history keeps every past version. That publicity is the registry’s integrity model, not a side effect.

Signing in runs through GitHub OAuth. The site stores a single signed, HttpOnly cookie holding your login and a few public profile facts, expiring after 24 hours. Two more cookies exist only during sign-in: one that checks the sign-in started here, and one that remembers which name you were claiming. Both last ten minutes and are cleared the moment you land back on the site. There is no account record on this side: the cookie plus GitHub is the whole identity. Sign out (or wait a day) and nothing about you remains on the server.

When a name is claimed, the request’s edge-inferred country (an ISO code like IN) is written into the record, and nothing more precise. It feeds the aggregate claim map on the stats page. It is never a city, never an IP address, written exactly once at the moment of the claim, and never refreshed or enriched afterwards. To remove it entirely, release the name (it goes back to the pool) and claim again.

runs-at.dev itself does no visitor fingerprinting, no location lookups on page views, and builds no profile from how you browse. The advertising described below comes from a third party and is covered separately.

One thing is counted: the site uses Vercel Analytics, which records page views without cookies and without identifying visitors. It tells the operator which pages get used; it cannot follow a person across pages, sites, or visits.

runs-at.dev shows banner advertising provided by HilltopAds. There are three 300×250 banners, and none of them runs on claimed *.runs-at.dev names.

• One on the homepage. It loads lazily: nothing is requested from HilltopAds for it until the banner comes close to the visible part of the page.
• Two beside the content, one on each side, on the documentation, the FAQ, and the about, policy, privacy, contact and blog pages. They appear, and their code loads, only on screens at least 1680 pixels wide; on smaller screens nothing is requested for them. They are not used on the homepage, the stats page, the manage and admin pages, sign-in, the API, or the debugging and profile-card pages.

Once a banner loads, your browser connects to HilltopAds’ servers to fetch and display the ad. Like other advertising technology, HilltopAds may receive and process technical information about that request to deliver and measure ads. What it collects, and how it uses it, is described in HilltopAds’ privacy policy. runs-at.dev does not pass your GitHub sign-in to HilltopAds, and the session cookie is marked so that no script on the page, the ads’ included, can read it.

GitHub’s API (your public profile fills the sign-in session and the profile card), live DNS resolvers (to answer the “is it working?” panel), Vercel (which hosts the site and counts page views), and Cloudflare (which runs the DNS for runs-at.dev and answers every claimed name before passing the request on). A visit to any*.runs-at.dev name therefore passes through Cloudflare. None of these receive anything beyond what is needed to answer your request. Some pages also load banner ads from HilltopAds, as described under Advertising above.

Release the name on the manage page and the record (country field included) is deleted from the registry. Git history on the public repo keeps past versions of records, as it must for a registry whose integrity is its history; truly sensitive data should never go into a record in the first place.