Private repositories and privacy
The short version: public code is drawn on the server and cached. Private code is drawn in your browser and never reaches the server.
Public repositories
Section titled “Public repositories”When you open a public repository or pull request, the server reads it from GitHub, draws it, and caches the result by commit so the next visitor gets it faster. The server checks that a repository is public before it lists, compares or searches it.
Private repositories
Section titled “Private repositories”Private repositories need you to sign in with GitHub.
- The page asks
api.github.comfor the files with your own access token. The code is parsed and drawn in a background thread of the page. - Code, file names and paths are never sent to the denoise server, never cached there and never logged.
- Nothing is stored in your browser either. What was read lives in the page’s memory and is gone when you close it.
- The token the page holds expires within hours and is kept in memory only. Signing out revokes it.
Sign-in
Section titled “Sign-in”Sign-in goes through the denoise GitHub App. The server swaps GitHub’s one-time code for tokens and keeps your session in an encrypted cookie that no script on the page can read. The cookie is sent to the sign-in endpoints only, never to other sites.
The app has read-only access to the contents, metadata and pull requests of the repositories you choose when you install it. It cannot write, comment or change settings. You can change those repositories or remove the app in your GitHub settings under Applications.
What stays in your browser
Section titled “What stays in your browser”Display choices, such as your zoom level and which functions you have seen, are kept in your browser’s local storage. Code and tokens are not.
A “Seen” tick keeps the function’s file and name and a short hash of its code and of the flow around its calls, so that the next push of the pull request can tell what changed since you looked. The hash cannot be turned back into code. It is made by the server for a public repository and by your browser for a private one, like everything else about private code, and it stays in local storage with the tick: it is never sent anywhere.
Without a browser
Section titled “Without a browser”The denoise-data command runs the same engine on your machine, on a local checkout or on GitHub with your own token, and prints JSON. Nothing goes to the denoise server. See CLI, JSON and MCP.
The MCP server reads public repositories only.
The full statement
Section titled “The full statement”Security and your code is the page the app links to. It is the one to trust if the two ever differ.