Complication charts the history of software repositories. This is what it keeps about the people who use it.
A visitor who does not sign in is not tracked. There is no analytics, no advertising and no script from another site. The browser keeps a few settings of its own in local storage, such as the last repository opened and saved views; they never leave the browser.
Signing in with GitHub keeps your GitHub login, your avatar's address, your primary verified email address, and a GitHub token that reads what you can see, so the repositories you choose can be checked and collected. A session lasts 30 days, or until you sign out. Two cookies make this work, and nothing else: complication_session and, for the ten minutes of a sign-in, complication_oauth.
The server keeps the repositories you choose, your saved views, your monitors and digests, and, if you subscribe, your Stripe customer and plan. A note you add to a repository is shown with your login to everyone who can open that repository.
The charts are made from a repository's git history and from what GitHub says about its CI runs and pull requests: commit authors and pull request authors appear by the names those records give them. A private repository is shown only to people GitHub still lets see it.
GitHub handles the sign-in. Stripe handles payment; this site never sees a card number. Postmark sends the emails you ask for. Cloudflare carries every request to the server.