Privacy Policy

Last updated: April 10, 2026

What Commit does

Commit is a browser extension that displays verifiable trust scores for GitHub repositories, businesses, and services. It fetches publicly available data and shows a Commit Score alongside the pages you visit.

Data we collect

The extension itself collects no personal data. Specifically:

• No accounts. There is no sign-up, login, or user profile.
• No tracking. No analytics, telemetry, or usage tracking of any kind.
• No cookies. The extension does not set or read cookies.

What is stored locally

• Ed25519 keypair — generated on install and stored in chrome.storage.local. Used to sign endorsements. Never transmitted unless you explicitly endorse a repository.
• Trust card cache — API responses are cached locally for up to 1 hour to reduce network requests. Cache is automatically cleaned up.

Network requests

The extension makes requests to commit-backend.fly.dev to fetch trust card data for repositories you visit on GitHub and GitHub links that appear in Google search results. These requests contain only the repository identifier (e.g. owner/repo). No personal information is included.

Endorsements

If you choose to endorse a repository, your public key and a signed endorsement message are sent to the Commit backend. This is a deliberate action — no data is sent without your explicit interaction.

Third-party services

The Commit backend uses the GitHub API to fetch public repository metadata (stars, contributors, commit history). No user-specific GitHub data is accessed.

Changes to this policy

If this policy changes, the updated version will be posted at this URL. The extension does not auto-update its privacy policy — you can always check the current version here.

Contact

Questions about this policy can be directed to the Commit GitHub repository.