Privacy Policy

Welcome to GitPilot. Your privacy and the security of your developer credentials are our highest priorities. This Privacy Policy describes how we handle data and our commitment to protecting your personal information when using the GitPilot Chrome Extension.

1. Zero-Server Commitment & Privacy-First

GitPilot is built as a Client-Only application that runs entirely within your web browser. We do not own, run, or maintain any middleman servers to collect your data, store configuration settings, or track your behavior. All communications with GitLab occur directly from your browser to official GitLab API endpoints (or your organization's self-hosted instances).

2. Data Processed by the Extension

To provide unified workspace and branch management features, GitPilot saves certain configuration details locally on your device:

• GitLab Personal Access Token (PAT): Provided by you to authorize the extension to query GitLab APIs. This token is stored exclusively on your local device and is never sent to any external server other than GitLab.
• GitLab Instance URL: The URL of the GitLab server (defaults to gitlab.com or your self-hosted GitLab domain).
• User Interface Preferences: Display modes, branch search filters, and personalization configurations.

3. Data Encryption & Security

Personal Access Tokens grant write and read access to your code repositories, making them extremely sensitive. GitPilot protects them with strict security protocols:

• AES-GCM 256-bit Encryption: Before your Personal Access Token is saved into Chrome local storage, it is encrypted using the industry-standard AES-GCM algorithm via the browser's native Web Crypto API.
• Unique Local Encryption Key: The key used to decrypt the token is randomly generated, stored in the extension's protected storage partition, and cannot be accessed from outside scripts.
• Mandatory HTTPS Connections: Every API call from the extension to your GitLab server is forced to run over HTTPS to secure transmission and prevent Man-in-the-Middle (MitM) eavesdropping.

4. Chrome Extension Permissions

GitPilot requests only the absolute minimum permissions required to perform its actions:

• storage: Needed to save your encrypted configurations and preferences locally.
• alarms & notifications: Runs a background service worker to periodically sync merge requests or build pipelines and show system notifications when statuses change.
• host_permissions: Pre-approved default access is restricted strictly to https://gitlab.com/*.
• optional_host_permissions: Allows the extension to request runtime host permissions dynamically for self-hosted/custom GitLab instances only when you explicitly connect them, ensuring maximum security and user control.

5. Third-Party Libraries & Tracking

GitPilot does not contain any telemetry, analytics, or behavioral tracking scripts (such as Google Analytics or Mixpanel). We do not share, sell, distribute, or license any of your workspace metadata or Personal Access Tokens to third parties under any circumstances.

6. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to align with new feature releases or Chrome Web Store policy updates. Any changes will be posted directly to this page. We encourage you to review this policy periodically to stay informed about our security practices.

7. Contact Support

If you have any questions, feedback, or security concerns regarding GitPilot or this policy, please reach out to us through our open-source GitHub repository or the developer support channel on the Chrome Web Store.