Privacy policy
Effective 2 September 2026 · applies to the sidebranch CLI and the sidebranch browser extension
sidebranch collects nothing. There is no account, no analytics, no telemetry, no advertising, no tracking, and no server operated by us for the tool to talk to. The software runs entirely on your own machine and communicates only with itself.
What is stored, and where
Everything below stays on your device. None of it is transmitted to us or to any third party, and none of it is readable by websites you visit.
| Value | Stored by | Where | Why |
|---|---|---|---|
| Daemon port | Extension | chrome.storage.sync |
One integer, written only if you change the port from the default 49400. |
| Widget corner | Widget | localStorage on your dev server’s own origin |
Remembers which corner you dragged the pill to. |
| Hidden-for-session flag | Widget | sessionStorage on your dev server’s own origin |
Keeps the widget dismissed until you reload. |
| Worktrees and logs | CLI daemon | ~/.sidebranch/ on your filesystem |
The git worktrees and dev server output the tool manages. Removed by sidebranch clean. |
One clarification about the first row, because “stays on your device’” deserves an
asterisk: chrome.storage.sync is Chrome’s own synced storage. If you are signed
into Chrome with sync enabled, Chrome will replicate that port number across your signed-in
browsers via your Google account, under Google’s privacy policy rather than this one. It is a
port number and nothing else, but we would rather say so than let “local” do work it
hasn’t earned.
Permissions the extension requests
storage
Stores the single integer described above. Nothing else is ever written.
http://localhost/* and http://127.0.0.1/*
The extension injects its widget into pages served by your own local development server, and talks to the sidebranch daemon running on your machine. These are the only origins it requests. It cannot run on, read, or modify any other website — ordinary browsing is outside its declared scope entirely, and Chrome enforces that, not us.
Network activity
The extension and the widget make requests to exactly one destination: the sidebranch
daemon on 127.0.0.1 (or localhost), on your own computer. The daemon
binds to the loopback interface only, refuses any request whose peer address is not loopback,
and validates the Host and Origin headers on every call. Nothing
leaves your machine. The full threat model is documented in
SECURITY.md.
Remote code
None. The extension executes only the JavaScript bundled in its package. Nothing is fetched and evaluated at runtime; the daemon serves data, never code to be executed.
Limited use
Use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. As stated above, no user data is received, collected, or transferred at all, so those requirements are met vacuously rather than by policy.
Children
sidebranch is a developer tool and is not directed at children. Since it collects no data, it collects none from anyone of any age.
Changes
If this policy changes, the effective date above changes with it and the revision is visible in this file’s git history. Material changes will be noted in CHANGELOG.md.
Contact
Questions about this policy, or a suspected security issue, go to GitHub Issues. For security reports specifically, follow the disclosure process in SECURITY.md.
Terms of use
Effective 2 September 2026
License
sidebranch is free and open source software, released under the MIT License, which is the operative agreement governing your use of it. The bundled Geist Pixel font is licensed separately under SIL Open Font License 1.1.
No warranty
The software is provided “as is”, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages, or other liability arising from the software or its use. This restates the MIT License, which controls.
What the tool does to your repository
sidebranch runs git commands on your behalf. By design it never runs a mutating
git command against your primary working tree — reads only. All checkouts happen inside
isolated worktrees under ~/.sidebranch/projects/, and a worktree with uncommitted
changes fails closed rather than being silently reset unless you explicitly ask it to discard.
That said, it is your repository and your machine. You are responsible for your own backups and for reviewing what the tool does before running it against work you cannot afford to lose. The source is short and readable precisely so that you can.
Intended use
sidebranch is a local development tool. It is meant to run on a developer’s own machine against a dev server on loopback. Do not expose the daemon to a network interface other than loopback, and do not run it on a shared or multi-tenant host; its security model assumes a single trusted user on the local machine.
No affiliation
sidebranch is an independent project. It is not affiliated with, endorsed by, or sponsored by Google, GitHub, Chrome, or any framework or package manager it interoperates with. All trademarks belong to their respective owners.