Skip to content

Privacy Policy

Last updated: June 23, 2026

Overview

Scout is a Chrome extension that adds an AI-powered review sidebar to GitHub pull request pages. This policy explains what data Scout handles, how it is used, and what stays on your device.

Data stored on your device

Scout stores the following in chrome.storage.sync — local to your browser and synced across your Chrome profile:

  • Anthropic API key or AWS Bedrock credentials (access key ID, secret access key, optional session token, region, model ID)
  • GitHub personal access token (optional)
  • UI preferences: sidebar width, analysis language, display settings

These values are never sent to Scout servers. They leave your device only as authentication headers in requests you initiate to the APIs you have configured (GitHub, Anthropic, or AWS Bedrock).

Data sent to third-party APIs

When you click the Scout button on a pull request, Scout sends the following to the AI provider you have selected:

  • The PR title, description, and author name (fetched from GitHub API)
  • The list of changed files and their diffs

This data is transmitted directly from your browser to Anthropic (api.anthropic.com) or AWS Bedrock (bedrock-runtime.*.amazonaws.com), depending on your settings — it does not pass through a Scout server, and Scout does not log or store it. The one exception is Scout hosted mode, described below.

Usage of each provider is governed by their respective privacy policies:

Scout hosted mode (beta)

If you select the “Scout hosted” provider instead of adding your own API key, the request path changes: the PR title, description, author name and the changed files with their diffs are sent to a Scout server, which forwards them to Anthropic using Scout's own API key and returns the answer to your browser.

  • Scout's server sees the diff content for the duration of the request. It is not written to disk and not retained after the response is returned.
  • What is recorded for each hosted request: your GitHub user id, the model used, the number of input and output tokens, the computed cost, and a timestamp. This exists to enforce the per-user daily limit and the overall spending cap.
  • Your prompt text, the diffs and Anthropic's answers are not stored.

Hosted mode is opt-in and off by default. Every other provider keeps your diffs in your browser — they go straight from your machine to Anthropic or AWS, and never touch a Scout server.

Data we do not collect

  • We do not collect personal information (name, email, address)
  • We do not track browsing history or web activity
  • We do not use analytics, telemetry, or crash reporting
  • We do not serve ads or share data with advertisers

Permissions used

  • storage — saves your API credentials and preferences locally
  • activeTab — reads the URL of the active GitHub PR page to extract the repo and PR number
  • scripting — injects the sidebar UI into GitHub PR pages
  • Host permissions (github.com, api.github.com, api.anthropic.com, amazonaws.com) — required to fetch PR data and call the AI provider you have configured

Contact

Questions about this policy? demetrgonchar@gmail.com