Run Anywhere, a YC company (W26), and AI firm Voice.AI are scraping GitHub activity to send unsolicited marketing emails to developers. Users report personalized emails referencing their GitHub contributions without consent, potentially using commit metadata for targeting. The practice raises privacy concerns, especially for those protected under GDPR.

The issue has prompted complaints from affected developers who received these targeted messages. One recipient contacted both organizations with no response, then escalated the matter to GitHub and YC Ethics. The problem appears systemic, with multiple commenters reporting similar experiences from various companies.

This practice exploits publicly available GitHub commit metadata for commercial purposes without user permission. Developers who share their email on GitHub typically assume it will be used for legitimate collaboration, not unsolicited marketing. The lack of response suggests either disregard for privacy concerns or unclear legal boundaries around data scraping.