Privacy policy

Three things, and nothing else:

• The URL of the GitHub page you are on. Read only when you press the button, and only to work out which repository, branch and directory to fetch.
• Source files from that repository. Fetched from GitHub’s public API and CDN, held in memory while the check runs, then discarded. Nothing is written to disk.
• A GitHub personal access token, if you choose to add one. Stored using Chrome’s local extension storage on your own machine. It is sent to github.com as an authorisation header and to nowhere else. You can remove it at any time from the extension’s Options page.

Entirely in your browser. The parser and the rules are bundled inside the extension and execute in its own service worker on your machine. No source code, no findings and no repository name is transmitted to Wyro. There is no Wyro server involved in a check at any point.

Two hosts, both GitHub’s:

• api.github.com — one request per check, to list the repository’s files.
• raw.githubusercontent.com — to read the contents of those files.

The extension makes no other network requests. It contacts no analytics service, no error reporter and no Wyro endpoint.

No. It collects no personal information, builds no profile, sets no cookies, and has no analytics or telemetry of any kind. There is nothing to sell, share or transfer, and nothing is used for advertising, credit assessment or any purpose unrelated to the check you asked for.

• storage — to keep an optional GitHub token on your machine, so you are not re-entering it on every check.
• https://api.github.com/* — to list a repository’s files.
• https://raw.githubusercontent.com/* — to read those files.
• A content script on https://github.com/* — to place the button on repository pages and draw the results panel. It reads the page’s URL and adds its own elements; it does not read page content, form fields or anything you type.

When findings exist, the panel offers a link to wyro.in. Following it opens a new tab with the repository’s owner, name, branch and subdirectory in the address — the same details already visible in the GitHub URL you were on. No source code, no findings and no token are sent.

Wyro then reads that repository from GitHub itself, in that tab, so the extension remains a thing that uploads nothing. Following the link is entirely your choice; the check works without it.

If you add a token that can see private repositories, the extension can check them. Their source is fetched into your browser and analysed there under exactly the same terms as a public one — it is not transmitted to Wyro, and it is discarded when the check finishes.

The extension is a developer tool and is not directed at children under 13, and we do not knowingly collect information from them. As stated above, we collect no personal information from anyone.

If the extension ever handles data differently, this page changes in the same release and the date above moves. Material changes will also be noted in the extension’s store listing.

Questions about any of this: dominicpaaul008@gmail.com. Wyro’s general terms and the web application’s privacy policy are at wyro.in/legal.