What the plugins send and what they never send

Until you select "Sign in with GitHub" in the settings, a plugin makes no network requests. The free features need no account.

Sign in uses the GitHub device flow. The plugin sends its public client ID and the scope read:user to github.com/login/device/code, then shows you a code.

While you enter the code at github.com/login/device, the plugin asks github.com/login/oauth/access_token every few seconds whether sign in is done.

The scope read:user is read-only access to your profile, which GitHub needs to show the sponsorship tier. It gives no access to repositories and no write access.

After sign in, the plugin sends one query to api.github.com/graphql. It asks whether your account sponsors theluckystrike, at which tier, and how much you've paid in total.

The plugin asks again at most once every 7 days, or when you select Refresh. Pro keeps working for 14 days without a successful check.

No plugin sends note content, file names or other vault data. None has telemetry.

GitHub handles the payment. The sign in and the sponsorship check go to github.com and api.github.com, and to no other host.

The GitHub token stays in the secret storage of Obsidian on your device. It isn't written to data.json or other vault files, so it doesn't sync or reach a git repository.

The local storage of that device keeps your GitHub login, the tier and the time of the last check.

Select Sign out in the plugin settings, and the plugin deletes the token. You can also revoke the access in your GitHub settings, under Applications.

This site has no analytics, no cookies and no requests to third parties. The build checks every page for that before it goes live.

Links to GitHub and to the Obsidian directory open those sites only when you select them.