Skip to content

feat:add terms of service and privacy policy #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ri1tik wants to merge 2 commits into
base: main
Choose a base branch
from
+393 −2
Open

feat:add terms of service and privacy policy #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d818abd
feat:add terms of service and privacy policy
Ri1tik Aug 8, 2026
a62ba02
fix: improve with the code rabbit feedback
Ri1tik Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
177 changes: 177 additions & 0 deletions privacy-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,177 @@
# Privacy Policy

**Last updated: August 2026**

## Introduction

At OrgExplorer, we respect your privacy.

This Privacy Policy explains what data OrgExplorer handles and how — and, just as importantly, what it does **not** do.

OrgExplorer's architecture is different from many applications because it operates entirely in the browser. It has **no backend server and no user accounts**.

---

## Information We Collect

OrgExplorer does not have:

- User accounts
- Signup or waitlist systems
- A backend server operated by us

Because of this, we do not collect, receive, or store any personal information about you on any system we control.

### What the App Handles

#### Data fetched from GitHub

When you search an organization, publicly available GitHub data is fetched directly from GitHub's API by your browser.

This may include:

- Repository information
- Contributor information
- Issues
- Pull requests
- Other publicly available GitHub metadata

This data never passes through a server operated by OrgExplorer.

#### Data stored locally on your device

The following data may be stored locally in your browser:

- GitHub Personal Access Token (if provided)
- Cached GitHub API responses
- API rate-limit status
- Recent search history
- Application preferences

This data is stored only in your browser's:

- `localStorage`
- `IndexedDB`

OrgExplorer does not transmit this data to any server operated by us.

When a GitHub Personal Access Token is provided, your browser uses it to authenticate requests directly with GitHub's API. The token is sent only to GitHub for authorized API requests and is never sent to OrgExplorer servers.

#### Standard Hosting Logs

OrgExplorer is hosted on GitHub Pages.

GitHub, as the hosting provider, may collect standard infrastructure logs such as:

- IP addresses
- Request timestamps
- Other operational metadata

OrgExplorer maintainers do not have access to these logs.

For more information, see [GitHub's Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement).

---

## How We Use Your Information

Since OrgExplorer does not collect or receive your personal data, we do not use, analyze, sell, or process your information.

All locally stored data exists only to make the application function properly, including:

- Reducing repeated GitHub API requests through caching
- Preserving your preferences
- Allowing you to avoid entering your Personal Access Token repeatedly

---

## Data Sharing and Disclosure

We do not sell, share, or disclose your data.

This is because OrgExplorer does not collect your data in the first place.

The only external communication occurs directly between:
```
Your Browser
|
|
v
GitHub API (api.github.com)
```
Comment on lines +95 to +101

@coderabbitai coderabbitai Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fix the Markdown code fence.

Add a blank line before the fence and specify a language such as text. This resolves MD031 and MD040.

Proposed Markdown fix 
 The only external communication occurs directly between:
 
-```
+```text
 Your Browser
 |
 |
 v
 GitHub API (api.github.com)
</details>

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.23.2)</summary>

[warning] 93-93: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)

---

[warning] 93-93: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @privacy-policy.md around lines 93 - 99, Update the Markdown code block
around the “Your Browser” diagram by adding a blank line before the fence and
specifying the text language on the opening fence, while preserving the diagram
content and closing fence.


</details>

<!-- fingerprinting:phantom:poseidon:caracal -->

<!-- cr-indicator-types:potential_issue -->

<!-- cr-comment:v1:819215c018eea40b55e853fa -->

_Source: Linters/SAST tools_

<!-- This is an auto-generated comment by CodeRabbit -->



This communication is governed by:

- [GitHub Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service)
- [GitHub Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement)

---

## Data Security

Because OrgExplorer has no backend server or database, most server-side data security risks do not apply.

The relevant security considerations involve data stored on your own device.

### GitHub Personal Access Token

If you choose to provide a GitHub Personal Access Token:

- It is stored only in your browser's `localStorage`
- It is sent only to GitHub's API
- It is never logged by OrgExplorer
- It is never transmitted to OrgExplorer servers

### Token Safety Recommendations

We recommend:

- Using a token with the minimum permissions required
- Avoiding unnecessary scopes
- Revoking your token from GitHub settings if you suspect misuse

Please note that browser `localStorage` is not encrypted.
Comment on lines +117 to +134

@coderabbitai coderabbitai Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

if [ -f privacy-policy.md ]; then
  echo "== privacy-policy.md line count =="
  wc -l privacy-policy.md
  echo "== relevant lines =="
  nl -ba privacy-policy.md | sed -n '1,155p'
else
  echo "privacy-policy.md not found"
  fd -i 'privacy.*policy.*md'
fi

echo "== search for token/localStorage references =="
rg -n "Personal Access Token|localStorage|localStorage|GitHub|tokens|token" privacy-policy.md . --glob '!node_modules' --glob '!dist' --glob '!build' | head -n 200

Repository: AOSSIE-Org/OrgExplorer

Length of output: 278

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== privacy-policy.md line count =="
wc -l privacy-policy.md

echo "== relevant lines =="
awk '{printf "%5d\t%s\n", NR, $0}' privacy-policy.md | sed -n '1,155p'

echo "== search for token/localStorage references =="
python3 - <<'PY'
from pathlib import Path
patterns = ["Personal Access Token", "localStorage", "GitHub API", "never leaves", "minimum permissions"]
file = Path("privacy-policy.md")
lines = file.read_text().splitlines()
for i, line in enumerate(lines, start=1):
    if any(p.lower() in line.lower() for p in patterns):
        print(f"{i}: {line}")

all_files = [p for p in Path(".").rglob("*") if p.is_file()]
terms = ["localStorage", "Personal Access Token", "github", "GitHub", "token"]
hits = []
for p in all_files:
    if "node_modules" in p.parts or "dist" in p.parts or "build" in p.parts:
        continue
    try:
        s = p.read_text(errors="ignore").splitlines()
    except Exception:
        continue
    for i, line in enumerate(s, start=1):
        if any(t.lower() in line.lower() for t in terms):
            hits.append((p, i, line[:160]))
hits = hits[:200]
for h in hits:
    print(f"{h[0]}:{h[1]}: {h[2]}")
print(f"total hits={len(hits)}")
PY

Repository: AOSSIE-Org/OrgExplorer

Length of output: 22928

Correct the Personal Access Token storage disclosure.

The summary at lines 45-56 says this list never leaves the device, but the Personal Access Token is sent to GitHub’s API. State that the saved copy remains in browser storage while authenticated requests send the token to GitHub. Also note the XSS exposure from persistent localStorage storage for sensitive tokens, and avoid persistent token storage if possible. If persistence is required, document that risk and require a minimum-scope, revocable token.

🧰 Tools
🪛 LanguageTool

[style] ~120-~120: This adverb was used twice in the sentence. Consider removing one of them or replacing them with a synonym.
Context: ...r browser's localStorage - It is sent only to GitHub's API - It is never logged by...

(ADVERB_REPETITION_PREMIUM)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@privacy-policy.md` around lines 115 - 132, Update the GitHub Personal Access
Token disclosure to clarify that the saved copy remains in browser localStorage
while authenticated requests send the token to GitHub’s API, rather than
claiming it never leaves the device. Document the XSS risk of persistent
localStorage storage, recommend avoiding persistence when possible, and state
that persistent tokens must use minimum scopes and remain revocable.

Source: MCP tools


---

## Your Rights

Since OrgExplorer does not collect or store personal information on our systems, there is no personal data held by us that you can request to:

- Access
- Correct
- Delete
- Export

You maintain complete control over locally stored application data.

You can remove stored data by:

- Clearing your browser storage
- Removing your Personal Access Token from the Settings page
- Resetting application data through browser settings

---

## Changes to This Policy

We may update this Privacy Policy as OrgExplorer evolves.

Any changes will be reflected on this page with an updated **"Last updated"** date.

We encourage users to review this policy periodically.

---

## Contact Us

If you have questions about this Privacy Policy, contact us:

**Email:** [aossie.oss@gmail.com](mailto:aossie.oss@gmail.com)

Or open an issue on [the project's GitHub repository](https://github.com/AOSSIE-Org/OrgExplorer).

---

*This policy describes OrgExplorer's actual technical behavior as of the date above. It is provided for transparency and is not a substitute for professional legal advice.*
6 changes: 4 additions & 2 deletions src/components/layout/Footer.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ const footerLinks = [
},
{
label: "Terms of Service",
href: "/terms",
href: "https://github.com/AOSSIE-Org/OrgExplorer/blob/main/terms-of-service.md",
},
{
label: "Privacy Policy",
href: "/privacy",
href: "https://github.com/AOSSIE-Org/OrgExplorer/blob/main/privacy-policy.md",
},
{
label: "API Status",
Expand Down Expand Up @@ -110,6 +110,8 @@ export default function Footer() {
<Link
key={item.label}
to={item.href}
target={item.href.startsWith("http") ? "_blank" : "_self"}
rel={item.href.startsWith("http") ? "noopener noreferrer" : undefined}
style={{
color: "var(--text2)",
transition: "color 0.2s ease",
Expand Down
Loading
Loading