What it talks to
- Cards sync only with the GitHub repository you named
- Connecting also calls GitHub’s authorisation and account endpoints, and nothing else
- The demo reads a public repository unauthenticated
- Purchases talk to the App Store / Google Play and the billing provider, purely to process the purchase. Only purchase and entitlement information is sent; there is no behavioural tracking
- No analytics SDK and no crash reporter are included
Where the token lives
- GitHub tokens are stored in the keychain only. They never leave the device and are never synced to iCloud keychain
- Settings shows a masked string. Nothing is written to logs
- Device settings hold only the repository name, branch, new-cards-per-day, and — for display — your account name and the token’s expiry (neither of which is secret)
How the permission is bounded
Anchor installs as a GitHub App. You choose which repositories it can see at install time, and repositories you did not pick are invisible to the app.
That is why the “read and write every repository you own” style of access was not used.
Your data stays yours
- The cards were already in your repository. They stay there if you delete the app
- The review log is in your repository too, readable as plain JSON Lines
- The app writes three files under
data/and never touches a card - Everything on the device can be erased from settings (nothing on GitHub changes)