RepoView Privacy Policy

Effective 5 August 2026 · Applies to RepoView version 1.1.0

RepoView collects nothing. It has no server, no account, no analytics and no tracking. Nothing you do in the extension is transmitted to the developer or to any third party. The only network requests it makes are to GitHub's own public API, on your behalf, to fetch the lists you asked to see.

1. What RepoView stores

Everything RepoView stores is kept locally in your browser profile using the Chrome storage.local API. It never leaves your device.

What	Why	How long
Your preferences: whether the button is shown, which tab opens first, whether a token is used	So the extension behaves the way you configured it	Until you change them or uninstall the extension
A GitHub personal access token, only if you choose to add one	To authenticate your requests to GitHub's API	Until you clear it or uninstall the extension
A short-lived cache of the account lists that GitHub returned (usernames, avatar URLs, profile URLs, star and fork timestamps)	So reopening the modal does not spend another request against your hourly GitHub API quota	About 7 minutes, and at most 60 cached entries

The cached lists contain only information GitHub already publishes on the repository's own public pages. RepoView does not build a profile of you, does not record which repositories you visit, and does not keep any history of your activity.

2. What leaves your browser

Two things, both going to GitHub and nowhere else:

Requests to https://api.github.com. When you open the modal, RepoView asks GitHub for the repository's watcher, fork and stargazer lists and its header counts. The request contains the repository name and, if you configured one, your personal access token. These requests are subject to GitHub's privacy statement.
Avatar images. The account avatars shown in the list are loaded by your browser directly from GitHub's image hosts, in the same way they load on any GitHub page.

There is no RepoView server. No request is ever made to the developer or to any analytics, advertising, crash-reporting or telemetry service.

3. Your personal access token

Since June 2026 GitHub serves its watcher and stargazer lists only to a repository's admins and collaborators, over authenticated requests. A personal access token is therefore needed for those two tabs, and they only show data for repositories your account owns or collaborates on. The forks tab and the tab counts work without a token. A token also raises your hourly GitHub API limit.

If you add one, it is stored in plain text in chrome.storage.local. Chrome does not provide extensions with a secure key store, and encrypting the token with a key that ships inside the same extension would only look like protection rather than provide it. This is stated plainly so you can decide accordingly:

Anyone with access to your browser profile can read the token.
Use the narrowest token that works. public_repo is enough for public repositories, and a fine-grained token limited to Metadata: read-only on selected repositories should be tighter still. A classic repo token also grants write access to everything you can reach, so keep it for the case where a private repository needs it.
The token is sent only to api.github.com, in the standard Authorization header, and to no other destination.
You can remove it at any time from the extension's options page.

4. Permissions and why they are needed

Permission	Reason
`storage`	Save your preferences and the short-lived list cache on your device
`https://github.com/*`	Add the Activities button and the modal to repository pages. RepoView reads the page only to find where to place the button, and reads the URL to know which repository you are on.
`https://api.github.com/*`	Fetch the watcher, fork and stargazer lists

RepoView does not request access to your browsing history, bookmarks, tabs, downloads, cookies or any site other than GitHub.

5. What RepoView does not do

It does not collect, transmit, sell, rent or share any personal or sensitive information.
It does not use your data for advertising, profiling or credit assessment.
It does not load or execute any remote code. All code is contained in the package you installed from the Chrome Web Store.
It does not read or modify pages outside github.com.
It does not read the content of repositories, issues, pull requests or private messages.

6. Deleting your data

Cached lists: open the extension's options page and choose Clear cached lists. They also expire on their own after about 7 minutes.
Your token: clear the token field on the options page.
Everything: uninstalling RepoView removes all of its local storage. Because nothing is held anywhere else, uninstalling is a complete deletion.

Since the developer holds no data about you, there is nothing to request, export or erase from a server. Any rights you may have under GDPR, CCPA or similar regulations are satisfied by the fact that no personal data is ever collected or processed outside your own browser.

7. Children

RepoView is a developer tool and is not directed at children. It collects no information from anyone, including children under 13.

8. Changes to this policy

If a future version of RepoView changes what it stores or where it sends requests, this policy will be updated before that version is published, and the effective date at the top will change. Material changes will also be noted in the extension's release notes.

9. Contact

Questions about this policy or about how RepoView handles data can be sent to jtech-bryan@proton.me.