For what it's worth, I don't believe maintainers have a moral or legal right to control what happens between third parties - that is, contributors to their project and those who wish to support them.

I wouldn't be opposed to implementing opt-out at a project level... but it's not my project.

As I told you on reddit, I'm going through hell trying to opt-out as an individual. I know for a fact that they harvested and have been using information about me from GitHub without my permission and in violation of GitHub's terms of service. Since your comments consistently resort to legalism, how do you resolve that conundrum? I'm honestly trying very hard to not just go with the nuclear option of starting to seek enforcement of service-provider terms to shut down tip4commit, but they aren't exactly leaving tons of other options.

If they're violating Github's T&C, that seems like a good place to start. You've obviously given them plenty of notice of your discontent - they've had ample opportunity to work with you to resolve it.

I guess they still have a moral right to ask their contributors to be up front about the incentives involved in their contributions (they can't demand disclosure, but they could still refuse contributions where they don't feel they have enough understanding of the incentives involved).

The point being, setting the thing up behind their back brings a lot of risk of poisoning the relationship between the contributor and the project.

Maybe it's stupid for a project to act like that, but once it turns into a hair splitting exercise, you might as well split all of them.

Devil's advocate: If you wish to tightly control everything related to your project then perhaps use a private CVS rather than a public repo on Github. By using Github's free and very social oriented service you are implicitly giving up some control over the project.