CodeSloth Privacy Policy

Last updated: 11 October 2026

CodeSloth is a browser extension that helps you review GitHub pull requests by suggesting a review order. It is built by Yash Verma. It has no servers, no analytics and no AI.

What CodeSloth handles, and where it stays

• Your GitHub token. You paste a fine-grained personal access token (we recommend Pull requests: Read-only and Contents: Read-only). It is stored only in your browser’s extension storage on this device, restricted to the extension’s own pages and background worker (GitHub pages and the in-page panel can’t read it). It is sent only as the Authorization header of read-only GET requests to api.github.com.
• Your GitHub username. Read from GitHub when you save the token, stored with it, and shown in the panel.
• Pull request data. For the PR you open, CodeSloth fetches the changed-file list, commits, and file contents from api.github.com and analyses them in your browser. Results and fetched file contents are cached locally (IndexedDB) to save API calls.
• Your review progress and settings. Which files you marked reviewed on which PR (with file hashes, to flag later changes), the panel position, and your settings are stored locally.

What CodeSloth does not do

• It does not send your code, token, or any other data to the developer or any third party. The only network destination is api.github.com (GitHub’s API), under your token.
• No analytics, telemetry, ads, tracking, or selling of data. No remote code.
• It never writes to GitHub through the API. The optional “Sync with GitHub Viewed” setting (off by default) clicks GitHub’s own “Viewed” checkbox in the page, as you would.

Your control

• Remove your token at any time with Clear token on the CodeSloth setup page; you can also revoke it on GitHub (Settings → Developer settings → Personal access tokens).
• Remove all CodeSloth data by uninstalling the extension. Cached analysis can also be discarded by re-analyzing a PR (⋯ → Re-analyze), which rebuilds the plan from GitHub.
• Data is kept until you remove it or uninstall; there is no server-side copy to delete.

GitHub

Data CodeSloth fetches comes from GitHub and is subject to GitHub’s own terms and privacy statement.

Limited Use

CodeSloth’s use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: data is used only to provide CodeSloth’s single purpose (suggesting a review order and tracking your review), is not transferred except as that policy allows, is never used for advertising, and is never read by humans.

Contact

For questions or bugs: open an issue at https://github.com/yashverma2110/codesloth-privacy/issues, or email the publisher address listed on the Chrome Web Store listing.