Privacy & GitHub Permissions

Signing in with GitHub

Planwright uses GitHub OAuth solely to verify your identity. When you click “Continue with GitHub”, GitHub asks you to approve two scopes:

• read:userYour public GitHub username and profile. Used to identify your account in Planwright.
• user:emailYour email address. Used for workspace invites and notifications.

That is all. Planwright does not request access to your repositories, organizations, or any other GitHub data during sign-in. GitHub shows you the exact scopes on their authorization screen before you approve anything.

The Planwright GitHub App (optional)

After signing in, you can optionally link a project to a GitHub repository. This requires installing the Planwright GitHub App on your account or organization. The App is separate from the OAuth login above — it is a distinct authorization that you grant only when you choose to connect a repo.

When you install the App, GitHub asks you to select which repositories to grant access to. You can choose all repos or specific ones. The App requests the following permissions on those repos:

• contents: readRead commit history to compute how much of the codebase was authored by agents vs. humans.
• pull_requests: writeRead PR details (title, status, merge state) to keep your board in sync. Write access allows Planwright to post status updates to PRs in future.
• metadata: readRequired by GitHub for all Apps. Provides access to basic repo metadata only.

The App also subscribes to push and pull_request webhook events. GitHub sends these events to Planwright's server when commits are pushed or PRs are opened, updated, or merged — so Planwright can automatically link that activity to objectives on your board.

What Planwright cannot do

The GitHub App permissions are enforced by GitHub — not just trusted on Planwright's side. With the permissions above, Planwright's server cannot:

• —Push code or commits to your repository
• —Merge, close, or create pull requests
• —Read or write issues
• —Access repositories you did not select during install
• —Access any data outside the granted scopes

How agents access your repositories

Coding agents (Claude Code, Cursor, Codex, etc.) commit and push code using their own credentials — typically your personal SSH key or a personal access token configured on your local machine. This is completely separate from Planwright. Planwright does not provide agents with any GitHub token and has no visibility into or control over what credentials agents use.

If you want to restrict which repositories an agent can access, create a GitHub fine-grained personal access token scoped to specific repos and configure that as your git credential. That is a GitHub account setting independent of Planwright.

Revoking access

• —OAuth login: revoke at github.com/settings/applications
• —GitHub App install: uninstall or adjust repo access at github.com/settings/installations