Privacy
Code Life Balance is designed so the recommended GitHub Action and local CLI can analyze GitHub activity without sending your GitHub credential or generated private report to a Code Life Balance service.
GitHub Action
The Action runs inside your GitHub Actions runner. The token you pass is used for GitHub API requests from that runner. Generated SVG, JSON, and Markdown files remain in the workflow workspace, repository, or GitHub artifact storage according to your workflow.
Local CLI
The CLI runs on your machine and can use GITHUB_TOKEN or your existing GitHub CLI authentication. It does not require a Code Life Balance account.
Public viewer
Public username reports use public GitHub information. No GitHub authorization is required from the visitor.
Optional GitHub App
The GitHub App is an advanced hosted mode. Installation credentials are created server-side only when needed and are not stored as long-lived installation tokens. Webhook requests are signature-verified. Persistent webhook history is off by default and stores only minimal event metadata when explicitly configured by the deployment owner.
Legacy hosted dashboard
The legacy OAuth dashboard remains during migration. In this mode a GitHub access token is stored in an encrypted, HTTP-only session cookie for the session lifetime. This is not the recommended zero-provider-access mode.
Analytics
The production website may load Vercel Analytics. The Action and CLI do not call Vercel Analytics and do not need the hosted website to operate.