Sonith Manakkat

Privacy policy

Privacy Policy: Repo Widget

Developer: Sonith. Contact: sonythm@gmail.com. Effective date: 2026-10-16.

Repo Widget (package com.sonith.repowidget) shows pull requests waiting on you, failed builds and green runs from GitHub on your Android home screen.

Summary

  • No account with us. No server of our own. We do not receive your data.
  • Your data stays on your phone. The only network calls go to GitHub (api.github.com), using your own token.
  • No ads. No analytics. No crash reporting. No tracking.

What the app stores on your phone

  • Your GitHub personal access token, in the Android secure store (expo-secure-store).
  • Your GitHub username and avatar address, from GitHub.
  • The repositories you watch (up to ten), their order and colours, and a cached list of repositories you can access.
  • Pull request details (title, author, repository, number, link, age, draft flag) and workflow run details (name, branch, result, time, link) from GitHub, and the latest counts shown in the widgets.
  • HTTP ETag values used to ask GitHub whether data changed.
  • Your settings: widget options, refresh interval, theme, notification choices, quiet hours, demo mode, onboarding state.
  • Notification events held back during quiet hours.

All of this is in a local SQLite database and the secure store, inside the app's private storage.

Network calls

The app contacts one host only: api.github.com over HTTPS, with your token in an Authorization header.

  • GET /user: checks the token and reads your username.
  • GET /user/repos: lists repositories you can access.
  • GET /search/issues: finds open pull requests that request your review in the repositories you chose.
  • GET /repos/{owner}/{repo}/actions/runs: reads the latest workflow runs for each chosen repository.

GitHub handles these requests under its own privacy statement. The home-screen widgets never call GitHub; they show the last saved result.

Links you tap (a pull request, a workflow run, github.com/settings/tokens, this policy, the source code) open in your browser on github.com. GitHub then governs those pages.

The app checks whether the phone is online with Android's own network status. It does not contact any other server for this.

Permissions

  • INTERNET: to call api.github.com.
  • POST_NOTIFICATIONS: to show optional notifications for failed builds and review requests. Off until you turn them on. Notifications are created on the phone.
  • RECEIVE_BOOT_COMPLETED: so background refresh and widgets resume after a restart.
  • ACCESS_NETWORK_STATE, WAKE_LOCK, VIBRATE, FOREGROUND_SERVICE: added by the libraries the app uses, for connectivity checks, background refresh and notification vibration.

The app does not ask for your contacts, camera, microphone, location, calendar, photos, files or SMS.

Sharing

We do not sell or share your data. If you use "Export data as JSON" in Settings, the text goes to the app you choose in the Android share sheet. The export does not include your token.

Backups

Android may include the app's local database in your device's own backup (Google backup, if you have it on). The token is excluded from backup by the secure store's backup rules. VERIFY ON DEVICE: that the rules files are present in the release build.

Deleting your data

  • Settings, Disconnect removes the token from the phone.
  • Settings, Delete all data removes repositories, cached data, settings and the token.
  • Uninstalling removes all app data.
  • To revoke access at GitHub, delete the token at github.com/settings/tokens.

Children

The app is for developers and is not directed at children under 13. It does not knowingly collect data from children.

Changes

A changed policy will be published at the same address with a new effective date.

Contact

sonythm@gmail.com