TL;DR (Too Long; Didn't Read)
- ✅ Your data never reaches us — everything stays in your browser locally
- ✅ We only access GitHub APIs that you authorize
- ✅ No external tracking or analytics services (usage counters are stored locally only and never transmitted)
- ✅ The only third parties involved are GitHub (the service itself) and, if you buy Pro, ExtensionPay/Stripe for payment
- ✅ Open source and transparent
Introduction
GitHush ("the Extension") is a Chrome browser extension that helps you manage your GitHub notifications. This privacy policy explains how we handle your data.
Data Collection
We (the developer) never receive your data. The Extension operates entirely within your browser and does not send any information to servers we operate — we don't have any servers. The only external communication is with GitHub's API (which you authorize) and, optionally, the payment provider if you upgrade to Pro.
For transparency, these are the categories of user data the Extension handles, matching our Chrome Web Store disclosure:
- Authentication information — your GitHub OAuth access token, stored in your browser and sent only to GitHub's API to authenticate your requests.
- Personally identifiable information — your GitHub profile basics (username, display name, avatar), fetched from GitHub and stored in your browser to show who is signed in.
- Website content — your GitHub notifications (issue/PR titles, repository names, links), fetched from GitHub and cached in your browser.
None of this data leaves your browser except to communicate with GitHub itself.
What Data We Access
The Extension requests access to:
-
GitHub Notifications (via GitHub API)
- Purpose: To display and manage your GitHub notifications
- Scope: Read-only access to your notifications
- Authorization: You explicitly grant this via GitHub's OAuth device flow
-
GitHub User Information (via GitHub API)
- Purpose: To display your username and avatar
- Scope: Read-only access to your basic profile
- Authorization: You explicitly grant this via GitHub's OAuth device flow
What Data We Store Locally
The Extension stores data only in your browser's local storage using Chrome's chrome.storage API:
-
Authentication Token
- Purpose: To authenticate API requests to GitHub
- Location: Browser local storage (never transmitted to third parties)
- Removal: Deleted when you log out or uninstall the extension
-
Notification Data
- Purpose: To display notifications and track read/unread status
- Location: Browser local storage
- Removal: Cleared when you log out or uninstall the extension
-
User Preferences
- Purpose: To remember your filter settings, snooze preferences, etc.
- Location: Browser sync storage (synced across your Chrome browsers if signed in)
- Removal: Deleted when you uninstall the extension
-
Snoozed Notifications
- Purpose: To remind you about notifications you've snoozed
- Location: Browser local storage + Chrome alarms API
- Removal: Cleared when you log out or uninstall the extension
-
Local Usage Counters
- Purpose: Anonymous counters of upgrade-flow interactions (e.g., "upgrade button clicked") to understand which Pro features matter
- Location: Browser local storage only — these events are never transmitted anywhere and contain no notification content or personal data
- Removal: Cleared when you uninstall the extension
-
Subscription Status (Pro users only)
- Purpose: To enable/disable Pro features (Pro status, plan type, subscription date)
- Location: Browser local storage
- Removal: Cleared when you uninstall the extension
Data Sharing
We do NOT share any data with third parties. All communication happens directly between:
- Your browser ↔ GitHub's API (api.github.com)
- Your browser ↔ GitHub's website (github.com)
- Your browser ↔ ExtensionPay (extensionpay.com), only if you upgrade to Pro
No intermediary servers, no external analytics services, no tracking.
Third-Party Services
The Extension communicates with:
-
GitHub API (api.github.com)
- Purpose: To fetch notifications and user data
- Privacy Policy: GitHub Privacy Statement
- Data Sent: Your GitHub OAuth token (which you authorize)
-
ExtensionPay (extensionpay.com) — only if you upgrade to Pro
- Purpose: Subscription and license management for optional Pro features
- Privacy Policy: ExtensionPay Privacy Policy
- Data Shared: Email address (optional, for receipts and multi-device sync) and browser extension ID
-
Stripe (stripe.com) — only if you upgrade to Pro
- Purpose: Secure payment processing (PCI DSS Level 1 certified)
- Privacy Policy: Stripe Privacy Policy
- Data Shared: Payment details you provide during checkout — never seen or stored by the Extension
Payments (Pro Features)
GitHush offers optional Pro features via subscription or one-time purchase. Payments happen entirely on ExtensionPay's secure checkout pages powered by Stripe:
- ✅ We never see or store your credit card number, CVV, billing address, or bank details
- ✅ Only your subscription status (Pro yes/no, plan type) is stored locally in your browser to unlock features
- ✅ Cancel anytime via Settings → Manage Subscription (ExtensionPay portal)
- ✅ Refunds and the EEA 14-day right of withdrawal: contact support@extensionpay.com
Permissions Explained
The Extension requests the following Chrome permissions:
| Permission |
Purpose |
storage |
To store your preferences, auth token, and notification data locally |
alarms |
To check for new notifications on your chosen interval and wake snoozed notifications at the scheduled time |
https://api.github.com/* |
To fetch notifications from GitHub's API and mark them as read |
https://github.com/* |
To complete GitHub's OAuth device-flow sign-in |
Content script on extensionpay.com |
Required by the ExtensionPay library to process optional Pro payments; runs only on extensionpay.com pages |
Your Rights
You have full control over your data:
Right to Access
- All data is stored locally in your browser
- You can inspect stored data using Chrome DevTools → Application → Storage
Right to Delete
- Log out: Click "Logout" in the extension to clear all stored data
- Uninstall: Removing the extension deletes all local data
- Revoke access: Revoke OAuth token at github.com/settings/applications
Right to Export
- Data is stored in your browser's local storage (JSON format)
- You can export data manually via Chrome DevTools
Security
We take security seriously:
- ✅ OAuth Device Flow: No client secret exposed (secure authentication)
- ✅ No Backend: No servers to hack (data stays in your browser)
- ✅ Direct API Access: Communication only with GitHub's official API
- ✅ Open Source: Code is publicly auditable
- ✅ Minimal Permissions: Only requests necessary permissions
Open Source
GitHush is open source and transparent. You can inspect the code to verify our privacy claims.
Summary
GitHush is privacy-first:
✅ Your data never reaches us — no servers, no databases
✅ No external tracking or analytics services
✅ Only third parties: GitHub (the service itself) and ExtensionPay/Stripe for optional payments
✅ All data stays local in your browser
✅ Open source and transparent
✅ You're in full control