Your Privacy Comes First

Privacy Policy

Repo2Text runs entirely in your browser. We never collect, store, or view your files.

1. Zero Cloud Uploads

When you select folders or drop files, all reading, parsing, and formatting happen 100% in your local browser memory. Zero bytes of your code are uploaded to any server.

1. Local File Processing

Local folders, ZIP archives and documents are read, decompressed, analyzed and formatted in your browser. Remote GitHub and web imports require network requests; the services involved are explained below.

Zero bytes of your source code or uploaded files are ever transmitted to Repo2Text servers.

2. Client-Side Secrets & Credentials Trap

Sensitive filenames are excluded and recognized credential patterns are masked by default. The scanner is pattern-based and cannot detect every secret. Review your selection and export before sharing it.

  • Environment files (.env*)
  • SSH private keys (id_rsa, id_ed25519)
  • SSL / TLS certs (.pem, .key, .p12)
  • Cloud & Service tokens (AWS, GCP, Vault)

3. GitHub API & Personal Access Tokens

GitHub API imports request repository data directly from api.github.com. A supplied Personal Access Token is sent only to that host. The optional CDN mirror uses jsDelivr for public repositories.

  • Your token remains in transient JavaScript memory for that browser session only.
  • Your token is never written to disk, never logged, and never routed through any proxy server.
  • You can clear the token at any time by clicking "Reset" or refreshing your browser tab.

4. Local Storage & Zero Cookies

Browser localStorage can retain theme/language preferences, saved selection packs, task goals and import history. Saved packs and history can contain repository names and file paths; they do not contain source file contents or GitHub tokens.

  • Theme Mode: Remembering your Dark/Light mode preference (theme).
  • Export Options: Non-sensitive preferences such as chars-per-token ratio or line numbers.

Repo2Text uses 0 advertising cookies, 0 third-party tracking scripts, and 0 user profiling telemetry.

5. Verify Local Processing

Inspect the Network panel while importing local files to confirm how they are processed. GitHub and web imports intentionally make remote requests; request methods alone do not establish privacy.

// Verification Steps:
1. Press F12 or right-click Inspect Element.
2. Open the Network tab.
3. Drag & drop any large codebase or ZIP into Repo2Text.
4. Observe: 0 POST/PUT network requests are dispatched.

6. Review Before Sharing

Exports stay on your device until you copy, download or share them. When you paste an export into an AI service, that service receives it under its own data policies. Review the content and your organization’s requirements first.

Have Privacy Questions?

Reach out to our security & privacy engineering team anytime.

Contact Privacy Team

Remote sources and external providers

Local folders and documents are processed in your browser. GitHub imports request repository data directly from GitHub; the optional mirror uses jsDelivr for public repositories. GitHub credentials remain in session memory and are cleared by New Import. Web2Txt Direct mode requests the source website. Smart Auto and Fast Reader may send the URL to Jina Reader, AllOrigins, corsproxy.io or CodeTabs. Their servers may process or log that URL; do not submit private links or URLs containing credentials. This website does not load analytics or advertising trackers. Fonts may be requested from Google Fonts.