Permissions

What TierUp can see

Signing in hands a stranger a token. Here is exactly what it is good for, in plain language. GitHub will say the same thing on its own screen, in its own words — this is the version written by us, and you can read it before you go there or not at all.

Always
  • Your public profile: name, avatar, location, and the day you joined GitHub.
  • Your verified email address, so we can send the Monday digest.
  • How many contributions you made — including a count of private ones.
  • Your public commits, pull requests, reviews, and issues.
Never
  • Write anything, anywhere. No commits, no comments, no issues, no stars.
  • See any repository you did not tick.
  • Act on your behalf, or appear as you to anyone.
  • Keep access after you remove it — revoking takes effect immediately.
Only for repositories you tick, on the same screen

Most real work happens in private repositories. GitHub will show you a list and you choose — all of them, some of them, or none. For the ones you tick, read-only:

That screen will also mention read access to your public repositories. It is automatic for every GitHub app and cannot be switched off — it is not something we asked for, and public code is public anyway.

Continue to GitHub

GitHub asks who you are, then which repositories it may read — two screens, one after the other, and then your profile. You can change that list or remove the app whenever you like from your account page. Revoking takes effect immediately.

Already installed it from another machine? The same button signs you in with nothing to confirm, and leaves every repository you connected exactly as it is.

The code that handles this is right here. You can delete your account and revoke our access in one click, any time, from your profile.