Privacy
Privacy policy
Last updated: 14 September 2026
This policy covers the 9to5 coverage website, backend service, and Chrome extension for displaying coverage on GitHub pull-request pages.
Service data and access
9to5 coverage is operated by 9to5 software. The service stores GitHub account, organization, repository, and coverage metadata needed to provide coverage checks.
Coverage reports are parsed into run summaries and file-level coverage, including paths and line hit counts. The preview does not include a guaranteed retention period; keep your original reports in CI.
GitHub OAuth tokens and upload tokens are used only to authenticate users, synchronize repository access, receive uploads, and publish coverage feedback.
MCP access exposes stored coverage metadata—such as commit identifiers, file paths, line hit states, and coverage summaries—to an authorized client. It does not fetch or return repository source. OAuth grants follow current GitHub-visible repositories; optional API tokens can be narrowed to selected repositories and are stored as SHA-256 digests.
The free preview does not require payment details. Read the security overview for the access boundaries of upload tokens and MCP credentials.
Chrome extension data
On supported GitHub pull-request pages, the extension reads the repository owner/name, pull-request number, displayed commit SHA, file paths, and diff line numbers to display coverage beside the changes. It sends the repository owner/name, pull-request number, displayed commit SHA, file paths, and coverage query selectors to the 9to5 coverage backend at https://coverage.9to5.software over HTTPS to retrieve authorized reports. Selectors include report identifiers and versions, coverage format, status filters, page sizes, and pagination cursors.
The extension does not upload source code or collect browsing history outside supported GitHub pull-request pages. It includes no advertising or analytics SDK. Coverage results are held in memory while viewing a page, rather than saved in extension storage.
Sign-in and local storage
The extension uses the existing 9to5 coverage sign-in and OAuth authorization flow with PKCE, requesting read-only coverage access (coverage:read). Credentials authenticate requests; the backend checks repository access before returning coverage. GitHub receives its normal sign-in and page requests.
OAuth credentials are stored in Chrome extension storage restricted to trusted extension contexts. Access tokens and their expiry timestamps are held in session storage; refresh tokens and the OAuth client identifier are stored locally. Credentials are not synced through Chrome Sync. A refresh token allows the extension to obtain a new access token without asking you to sign in again.
Signing out and deleting local data
Signing out removes the locally stored refresh token and clears session storage, then attempts to revoke both tokens on the server. If revocation fails, local tokens are still cleared, but server revocation is not confirmed. The OAuth client identifier remains locally stored for future sign-in.
Expiry or server revocation makes a credential unusable; it does not by itself delete its locally stored copy. The extension replaces tokens when refreshing them and clears them when a refresh request reports that sign-in is required. Chrome clears session storage when the browser session ends. Removing the extension removes its extension storage, but does not itself revoke server credentials or delete backend records.
Data use and sharing
We use extension data to provide authorized coverage displays and operate, secure, and troubleshoot that functionality. The extension sends authentication and coverage requests to 9to5 coverage. The service uses GitHub for sign-in, repository access synchronization, and coverage feedback; Heroku for application hosting; and Sentry for backend error monitoring. These providers process the data needed for those services.
The absence of an analytics SDK in the extension does not mean the backend has no logging. The service records operational information, including coverage tool names, credential types, request outcomes, and durations, and may send backend error details to Sentry. These records support service operation and troubleshooting.
We do not sell extension user data or use it for advertising. Our use of extension user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Backend retention and privacy requests
Local extension storage is separate from the service's stored account, authorization, repository, coverage, and operational records. Signing out or removing the extension does not delete those backend records or reports uploaded by your CI. The free preview does not provide a guaranteed retention period or automatic deletion of these records when extension credentials expire or are revoked.
For privacy questions or requests to access or delete service data, contact 9to5 software at info@9to5.software. Please identify the account or repository concerned, without sending tokens or source code.