GH Reloaded doesn’t collect, sell, or share any data. Everything it stores stays in your own browser, and the only network calls it makes are directly from your browser to api.github.com, using your own GitHub token(s), and, for the GitHub Status feature, one anonymous request to www.githubstatus.com (GitHub’s official status page) — never to a server this project runs or controls.
Stored locally via the browser’s chrome.storage.local (never synced, never sent anywhere on its own):
ghmiView), whether its left sidebar is collapsed to an icon rail (ghmiSidebar), whether the My Issues feature is switched on (ghmiEnabled), and the optional minimum and maximum width of its Project tiles (ghmiTileMin, ghmiTileMax), whether PR triage on a repository’s Pull requests page is switched on (ghprtEnabled), whether the experimental Quick assignment on issue pages is switched on (ghqaEnabled, off unless you enable it; it sends one read-only request for the issue’s assignees to api.github.com to confirm a change and stores nothing from it), whether the linked-PR status on Projects board cards is switched on (ghlpsEnabled) and whether you dismissed its missing-token hint (ghlpsHintDismissed), and for GitHub Status whether it is switched on (ghgsEnabled), whether its incident notice is shown (ghgsNotice) and which incident notices you dismissed, as incident ids with the time of the update you dismissed (ghgsDismissed; entries for resolved incidents are removed); for the Image gallery whether it is switched on (ghigEnabled) and whether it opens automatically (ghigAutoOpen), and for the notifications engine, which of its modules are switched on (ghntModules), whether the native inbox is kept (ghntNativeInbox), which triage layout you picked in the inbox’s Triage settings panel (ghntLayout), how many days a mention counts as recent (ghntMentionWindowDays) and which sections of the Grouped sections layout are collapsed (ghntTriageCollapsed). Which Project tiles are collapsed is kept in memory only and never stored. The notifications engine reads pull request, issue, comment and review text from GitHub only to match it in memory; none of it is stored.The public status data the GitHub Status feature reads (overall indicator, affected components, open incidents and their latest update) is kept in chrome.storage.session, in memory only, for a few minutes and cleared when the browser closes. It is not personal data and is never synced.
Verify access (Settings → GitHub tokens) sends the token of the card you use to api.github.com, only when you click Run checks, for the repository, issue, project and file you name; the answers are shown on that page and nothing is stored.
None of this leaves your browser except the token itself, which is sent — over HTTPS, directly — only to api.github.com, only when a feature you’ve enabled needs to read issue, sub-issue, dependency, or Projects data, or when you click Run checks in Verify access. GitHub’s own privacy statement covers what GitHub does with that request.
The GitHub Status feature asks https://www.githubstatus.com/api/v2/summary.json for GitHub’s public status, from the extension’s background service worker, at most once every 5 minutes while a github.com tab is open and visible. When a request fails it retries sooner, after 30, 60, 120 and 240 seconds, and returns to every 5 minutes once it succeeds or the delay reaches that interval. The request has no query string, no cookies or credentials, no referrer and no token, and carries nothing about you, the page you are on or your repositories. It needs no extra permission. Switching the feature off in Settings stops the requests.
The Image gallery lists the images of the folder you are in from the page’s own data or, when that is not available, through the GitHub API (api.github.com, with your saved token only when one applies to the repository’s owner). The images themselves are loaded by your browser from the same GitHub image URL GitHub’s own page uses (github.com, which redirects to GitHub’s raw content host); no token is sent to those hosts and nothing about the images is stored. If an image cannot be shown, the extension may read that file through the GitHub API to tell why. The one-navigation exception after Open file on GitHub is kept in the extension’s memory only, for a few seconds, and is never written to storage, cookies or the URL.
To render its features, the extension reads issue titles, labels, comments, status and when it last changed, sub-issue and dependency relationships, the issues assigned to you (when you open your My Issues dashboard) together with which Projects they belong to and their issue type, and Projects v2 field values, and, for the pull requests listed on a repository’s Pull requests page, who is asked to review, each reviewer’s latest review verdict, the head commit and the checks result, and, for the issue cards on a Projects board, the pull requests explicitly linked to each issue with their state, review decision and checks result (and the names of failing checks when you open a details dialog) — from the GitHub page you’re on and from the GitHub API — and displays that information back to you, in your own browser. None of it is transmitted anywhere else, logged, or retained beyond what’s listed above.
Uninstalling the extension removes everything it stored. To clear it without uninstalling, remove your GitHub tokens from Settings, or clear the extension’s storage from chrome://extensions.
Questions about this policy or the extension’s data handling: open an issue at github.com/cattanisimone/gh-reloaded.