What Idlehand stores.
The web service keeps a small account record so you can sign in, pick repositories, and see what your local runner did. This is what is stored today, why it is kept, and how long it lasts.
What is stored, and why
After you sign in, Idlehand stores your GitHub user id, login, name, and avatar URL so the dashboard can show who you are.
The web app stores the OAuth access token GitHub issues at sign-in so it can list repositories on your account. The default scope is read:user.
When you approve a device login, Idlehand stores CLI tokens so your local runner can read your repository selections and post run-report summaries.
Your repository selections are stored so the next run knows what to work on, and so the public shortlist can show how many people included a project.
Each finished task can post run-report summaries (repository, kind, provider, outcome, optional URL, cost, and duration) so the dashboard can show recent work.
How long it lasts
The browser session cookie lasts 30 days. CLI tokens do not expire automatically; they remain valid until they are removed from the service.
Signing out clears that session cookie and does not revoke the GitHub OAuth access token or any CLI tokens. Account records, repository selections, and run-report summaries remain stored after you sign out.
Device-login codes expire after 15 minutes and are deleted once used. Token revocation is not part of this build.