1. Overview & Privacy First Architecture

This Privacy Policy explains how Mehtab Singh Mahingu ("we", "us", or "our"), through https://mmahingu.com and the GitHub Backup Manager application, treats your privacy and data. We operate under a fundamental architectural commitment: Complete Data Sovereignty & Zero Cloud Footprint.

GitHub Backup Manager is built for privacy-conscious developers. We do not maintain user databases of code, we do not ingest your Git repositories, and we do not run remote background telemetry on your codebase.

2. Information We DO NOT Collect

• Your Source Code & Repositories: All Git cloning, checkout trees, issue scraping, and release binary downloads happen 100% locally on your workstation. No repository data is ever uploaded to or stored on our servers.
• Your GitHub Personal Access Tokens (PAT): Your tokens and credentials stay exclusively in your browser memory or local companion configuration file (config.json) on your own device. We never receive or store your credentials on our web servers.
• Browsing & Usage Telemetry: We do not employ third-party behavioral analytics, keyloggers, session recordings, or telemetry trackers.

3. Information We Collect During Commercial Transactions

When you purchase an active usage pass (24-Hour, 48-Hour, 28-Day Pro, or Annual Access) for GitHub Backup Manager, transaction processing is handled securely by Dodo Payments, who serves as our Merchant of Record:

• Billing Information: Dodo Payments collects your email address, billing name, country, and payment details (Credit/Debit Card, UPI ID, Apple Pay) in order to process the payment, issue your receipt, and remit statutory sales tax/VAT.
• Payment Security: We never see, store, or process your credit/debit card numbers or UPI PINs. All sensitive payment processing occurs within Dodo Payments' PCI-DSS Level 1 certified environment.
• Transaction Metadata Received by Us: We receive only non-sensitive transaction confirmation metadata: your purchase email address, order reference ID, usage pass tier purchased (24-Hour Pass, 48-Hour Sprint, 28-Day Pro, or Annual Pass), and date of purchase for the sole purpose of customer support and refund verification.
• Operational Usage Pass & Download Telemetry: Under GDPR Article 6(1)(b) (Contract Performance) and 6(1)(f) (Legitimate Interests in Fraud Prevention, Dispute Defense & Quota Enforcement), when an active usage pass key is utilized, our server records operational download lifecycle logs: the target repository name, preset configuration (Option 1, 2, or 3), execution status (queued, started, completed, failed, cancelled), and engine diagnostic error codes/traces if an operation fails. This data contains zero repository source code or content and is retained strictly to enforce plan repository limits, defend against friendly chargeback fraud, and provide automated verification for technical defect refund claims.

4. Client-Side Browser Storage (Cookies & LocalStorage)

GitHub Backup Manager uses minimal, functional browser storage strictly necessary for user interface operation:

• rh_theme (LocalStorage): Remembers your dark/light theme preference.
• rh_gate_unlocked (SessionStorage): Remembers master passcode unlocking during your current browser session.
• No Advertising Cookies: We do not place advertising, profiling, or cross-site tracking cookies on your device.

5. Third-Party Service Providers

We work only with reputable, privacy-compliant service providers:

• Dodo Payments (Merchant of Record): Processes financial payments, manages currency conversion, tax compliance, and automated email receipts.
• GitHub REST API (Official Direct Requests): When using the Online Explorer or Local Companion, your workstation connects directly to official GitHub API endpoints (api.github.com) using your own connection and credentials.

6. Data Protection Rights (GDPR, CCPA & India DPDP Act)

Depending on your location, you have strong data protection rights regarding the limited transaction data we hold (email and order ID):

• Right of Access: You may request a summary of transaction records associated with your email.
• Right to Rectification: You may request updates to your billing contact information.
• Right to Erasure: You may request deletion of your purchase record, subject to mandatory accounting and tax record retention requirements.

To exercise any of these rights, simply email us at appsbymmahingu@gmail.com.

7. Data Security Standards & Local Loopback Architecture

Our website utilizes strict Transport Layer Security (TLS 1.3) HTTPS encryption, Secure Headers, and Chrome Private Network Access (PNA) safeguards to protect data in transit between your browser and local companion.

Local Loopback Boundary (127.0.0.1:4242): The companion daemon runs strictly on your machine's local loopback network adapter (127.0.0.1:4242). It does not broadcast to the public internet or external networks. When using the local dashboard (http://127.0.0.1:4242/), all communication remains 100% internal to your device. While third-party privacy shields (e.g. Brave Shields, uBlock Origin) may defensively restrict external websites (mmahingu.com) from querying your local PC, using the local dashboard tab ensures complete privacy, zero telemetry, and total independence from external network surveillance.

8. Contact & Privacy Officer

For any privacy inquiries, data subject requests, or security disclosures, please contact the creator directly:

Mehtab Singh Mahingu
Email: appsbymmahingu@gmail.com
Website: https://mmahingu.com
Jurisdiction: Punjab, India