Stars are public - navigating to any GitHub profile and clicking the 'Stars' tab shows all the repositories starred by the user. Moreover, all users that have starred a repository can be viewed by appending /stargazers to the repo url or clicking the stars link in the sidebar.

More importantly, there is an API endpoint for /stargazers.

If you really wanted to get GitHub data in bulk for illicit purposes and you know how to work with big data you can get it from the GitHub Archive but that’s a topic for another day. (Although it may not have user emails)

It's totally public, for example, here are the stars for the Vue repository: https://github.com/vuejs/vue-cli/stargazers, or the stars by its primary author: https://github.com/yyx990803?tab=stars

Like you, I definitely started starring repos before I knew these were public, years ago.

I’ve never quite understood why there isn’t a private way to bookmark repos.

Bookmarks are a private way to bookmark repos :P

It's not only public but new stars appear on the creator's GitHub news feed when they happen, with username included.

Any ssh pubkeys you've entered into your github account are public too, just FYI.

Did not know that…