GH Todos Privacy Policy

Engineering Editorial / Data Notice

Privacy, kept narrow.

This Privacy Policy explains how GH Todos handles information when you use the app to connect a GitHub Personal Access Token, read GitHub Projects and issues, and write issue or project updates back to GitHub. The app is designed to keep data collection limited to what is needed for those functions.

Last updated: April 16, 2026

01 / Controller

Who operates this app

The operator information for this policy will be completed with the legal name and contact details used for release.

Operator / controller: Christoph Bühler
Privacy contact: gh-todos.glimpse815@passmail.net

02 / Data Inventory

What information the app handles

Information you enter directly

  • Your GitHub Personal Access Token.
  • Issue titles, issue bodies, and comments you create or edit in the app.
  • Project-mapping choices you configure, such as priority-field mappings and due-date-field mappings.

Information the app reads from GitHub

  • Your GitHub account and organization context needed to list available Projects V2 workspaces.
  • Project metadata such as project IDs, owner login, field IDs, and field options.
  • Issue and comment data needed to render the feed and detail views, including titles, issue numbers, timestamps, comment counts, due dates, priority mappings, and open/closed state.
  • Linked repository metadata required for quick-add issue creation.

03 / Local Storage

What stays on your device

Secure token storage

The app stores your GitHub Personal Access Token locally using platform-secure storage where supported. In the app code, the token is stored under the local key github.personal_access_token.

Preferences and cached configuration

The app also stores selected project identifiers and mapped project settings locally so it can restore your workspace between sessions. This includes the selected project ID and your saved project mappings.

Local performance and offline cache

The app uses local Hive storage to cache GraphQL responses and related workspace data so the interface can render more quickly and, where available, show cached issue data while offline. In the current codebase, this includes a GraphQL cache box named graphqlClientStore and a Hive box named mappedProjects.

04 / Use

Why the app processes this information

The app uses data only for the core product workflow described in the repository: connecting to GitHub, selecting Projects V2, reading assigned issues, and letting you create or update items.

To authenticate API requests

Your token is read locally and attached to requests sent to the GitHub GraphQL API at https://api.github.com/graphql in the Authorization header.

To render your workspace

GitHub account, project, issue, and comment data is processed so the app can show your selected project feed, detail pages, recently closed issues, priority badges, and due dates.

To support fast local reads and offline fallback

Cached GraphQL responses and locally stored project mappings are used to reduce load times, preserve recently viewed workspace state, and display cached issue information when the device is offline and cached data is available.

To apply your changes

When you post comments, update issue text, close or reopen issues, set due dates, set project single-select values, or create issues through quick-add, the app sends the necessary data to GitHub to complete that action.

To preserve your local setup

Selected project IDs and project mapping preferences are stored locally so the app can reopen the same workspace without requiring you to configure it again.

05 / Sharing

Who receives data

GitHub

The app sends your token and requested mutation/query data to GitHub because GitHub hosts the Projects, repositories, issues, and comments the app works with.

Platform and hosting providers

Apple, Google, browser vendors, or other platform operators may separately process data through their operating systems, app-store infrastructure, or browser/runtime environment under their own terms and privacy notices.

No sale, advertising, or analytics sharing stated here

Based on the repository code reviewed for this policy, the app does not include advertising SDKs, marketing trackers, or third-party analytics packages. This policy assumes those are not added elsewhere before release.

06 / Retention

How long information is kept

Token

Stored locally until you replace it, remove it through the app, clear app data, or uninstall the app.

Local preferences

Stored locally until you change or remove them, clear app data, or uninstall the app.

Local cache copies

Cached GraphQL data and other Hive-backed local cache entries remain on the device until they are overwritten, cleared, the app data is reset, or the app is uninstalled.

GitHub-hosted content

Issue, comment, and project data created or updated through the app remains subject to GitHub’s own retention practices until you modify or delete it through GitHub or another authorized client.

07 / Security

How the app protects data

Local secret handling

The token is intentionally stored in a dedicated local secure storage service rather than in ordinary app state, route parameters, or URLs.

Transport

GitHub API requests are sent over HTTPS to the GitHub GraphQL endpoint.

Data minimization

The app is structured around a narrow GitHub workflow and does not, based on the reviewed code, request unrelated categories such as contacts, photos, health data, location, advertising identifiers, or payment data.

Limits

No storage or transmission method is perfectly secure. You should grant the minimum GitHub token scopes needed for your own use and revoke any token you no longer trust.

08 / Rights

Your privacy choices

  • You can remove the locally stored token from within the app.
  • You can delete saved projects and mappings by clearing app data or removing them in the app.
  • You can revoke or replace your GitHub token directly in GitHub.
  • You can exercise access, correction, deletion, or related rights for GitHub-hosted content through GitHub where that data is controlled by GitHub or your GitHub account.
  • If applicable law gives you additional rights, contact the operator using the contact details listed in this policy.

09 / International Transfers

Cross-border processing

Because the app communicates with GitHub and may be distributed globally, information may be processed in countries other than the country where you live. GitHub’s own terms and privacy disclosures govern GitHub’s handling of data after it receives it.

10 / Children

Children’s privacy

GH Todos is not directed to children under 13 and is not designed for child-oriented use. If you believe a child has provided information through the app, contact the operator and revoke any token involved.

11 / Changes

Policy updates

This policy may be updated if the app’s data practices, distribution channels, or legal obligations change.