Home Base privacy

Last updated 6 November 2026.

What is stored on our server

• Your GitHub user ID and username, which identify your account.
• The groups and sites you save, your design choices and any background or icon images you upload, so they appear on your devices.
• Your todos, scratchpad and the addresses you choose to monitor.
• Your projects, saved commands and tracked time. Projects can hold SSH commands and notes, and these aren't encrypted, so don't put passwords in them.
• Up to 7 days of check results for the addresses you monitor, plus daily uptime totals and an outage log for up to 400 days.
• A protected record of each signed-in device, including its browser type, kept until you sign out or for 90 days after it was last used.

What our server requests for you

To show the developer panels, our server requests your public profile, repositories, issues, pull requests and activity from GitHub, top stories from Hacker News, and any addresses you add as monitors or projects. For projects, it also reads each site's SSL certificate date and looks up its domain's expiry date through the public RDAP service at rdap.org, which sees the domain name. Those sites see the request as coming from our server, not from you. Your GitHub password is never involved, and private repositories are only read if you choose to connect them. Text in the dev toolbox stays in your browser and is never sent to our server.

What GitHub shares

Sign-in only requests your public GitHub profile. Home Base doesn't get access to your repositories, and it doesn't keep the access token GitHub provides. If your profile shows a public email address, it's checked at sign-in to identify the site's administrator and isn't stored.

Who can see your data

Other users can't see your data. The site's administrator can see each account's username, when it joined and was last seen, and how many groups, links and sessions it has. The admin dashboard doesn't show the sites or images you save, though the administrator operates the server and database they're stored on.

Optional private GitHub access

You can choose to connect a separate Home Base GitHub App, which can read the repositories you select and can't change your code, issues or settings. There's one exception: if the administrator gives the app the Actions read and write permission and you accept that on GitHub, you can re-run and start workflows in those repositories from this site. They only run when you ask, each deploy you start is recorded in the server's log, and a workflow can do whatever it's written to do, including deploying or changing code. Its access tokens are encrypted on our server, are never sent to your browser and are never shown to the administrator through the site. Pull requests, issues and repository details it reads are held in memory for a few minutes and not saved to the database. Disconnecting deletes the tokens and withdraws the access on GitHub, and you can also remove the app from your GitHub settings at any time.

What the Chrome extension reads

The extension reads your bookmarks and most visited sites so it can show them on your new tab page and include them in its search. They stay in your browser and are never sent to our server.

How your data is used

Your data is only used to run Home Base. It isn't sold, shared for advertising or used to track you across websites. Your data is stored on a private server, and Cloudflare carries traffic to and from it. Before each update to the site, the database is copied to a private folder on the same server. These copies aren't encrypted, apart from the GitHub tokens inside them, and they aren't kept anywhere else.

Removing your data

You can edit or remove your saved sites at any time. You can sign out other devices or permanently delete your account yourself, under Customize and then Account. This deletes everything listed above, except that copies of the database taken earlier stay on the server until newer ones replace them. The 14 newest are kept, and a new one is made with each update, so there's no fixed date for this.