GitHub Download Now does not sell user data and does not send data to the developer, analytics providers or advertising services.
The extension is designed for public GitHub repositories and fails closed when repository visibility cannot be established. The optional GitHub connection does not enable private-repository support.
The extension reads the public repository identifier, release tags and release assets available on the current page. Public page requests use credentials: omit, so GitHub session cookies are not attached. Release and navigation URLs are validated against the expected GitHub origin and repository.
The extension may query public directory listings and likely README files at api.github.com. It can follow up to three relevant links found in README documentation, with depth one, at most two linked directories and at most three additional documents. Same-repository links are kept on the selected release tag. Commands are linked, never executed.
Users may voluntarily connect GitHub through GitHub's official OAuth Device Flow. No OAuth scopes are requested. The connection raises the API limit for public release, documentation and watch requests.
api.github.com service.storage.local, is not synchronized and its local copy is removed by Disconnect. Server-side revocation remains available under GitHub Settings → Applications.Without a connection, the extension continues to work in anonymous public-only mode.
Optional download records, watched repositories, pending updates, ETags and scheduling metadata remain in storage.local. Preferences may be synchronized through storage.sync. System notifications are disabled by default and require the optional notification permission.
Except for the voluntarily supplied OAuth token, the extension does not access cookie values, GitHub passwords, private repository content, account profile or email data, the browser history database, general download history, personal communications or unrelated sensitive information.
The only network service queried is GitHub through github.com and api.github.com. There is no developer backend, telemetry, advertising or AI service. Information is used only for the extension's user-facing functionality and is not sold, profiled or made available for human review by the developer.
Firefox declares browsingActivity as required for the currently open public repository page and authenticationInfo as optional. Optional consent is requested only when the user chooses to connect GitHub.
Users can remain anonymous, connect or disconnect GitHub, disable the extension, select manual checks, remove watches, clear local history, disable notifications or uninstall the extension.