These terms govern your use of the Sextant browser extension and the companion
backend service at sextant.octago.nl (together, "Sextant" or the
"Service"). Sextant is operated by Knaxly Ltd. By installing the extension
or making requests to the backend, you accept these terms. If you do not
agree, do not use the Service.
Sextant is published by Knaxly Ltd at knaxly.dev/sextant, where you will also find this document, the privacy policy, and how to get in touch.
1. What Sextant is
Sextant is a free browser extension that decorates GitHub pages with analytics
and navigation tools: a "Lines of code" panel, a repo health card, dependency
vulnerability badges, TODO counts, a file tree sidebar, a pull-request
analyzer, a notification inbox, a permission auditor, an organisation
dashboard, and a command palette. It calls a hosted backend at
sextant.octago.nl to compute exact line-of-code counts, TODO
counts, dependency vulnerability summaries and pull-request analyses.
Sextant also includes optional AI features, off by default, which send repository content to Anthropic using an API key you supply. See section 3 and the privacy policy for what data is processed, where it goes, and how long it is kept.
2. Eligibility
You may use Sextant if you can lawfully agree to these terms. If you are acting on behalf of an organisation, you represent that you have authority to bind that organisation. Sextant is not directed at children under 13.
3. Your credentials and API keys
Sextant authenticates to GitHub on your behalf using either:
- A GitHub Personal Access Token (PAT) you paste into the extension's Options page; or
- A GitHub OAuth access token you obtain by clicking Connect GitHub and approving the code Sextant shows you on GitHub's device-authorisation page.
You are responsible for keeping your credentials secure and for revoking them if you suspect they have been compromised. You can revoke OAuth access at any time via github.com/settings/applications and delete a PAT via github.com/settings/tokens.
The backend treats every token as ephemeral: it is used to authenticate a single request's GitHub API calls and clone, and discarded when the request returns. It is never written to disk, never logged, and never used for any purpose beyond serving your own request. See the privacy policy for details.
AI features and your Anthropic API key. The AI features are
off until you enable them and enter your own Anthropic API key. When enabled,
using them sends repository content (including the contents of files you
attach from private repositories, pull-request diffs, pull-request and issue
text, issue comments and workflow-run details) from your browser directly to
api.anthropic.com, together with your key. The Sextant backend is
not in that path. You are responsible for:
- Having the right to disclose that content to a third-party AI provider, including under any employer, customer or licence obligations that apply to it;
- All usage charges Anthropic bills to your key; and
- Keeping the key secure and revoking it if it is compromised.
Sextant enforces local per-day request caps as a cost guard, not as a billing guarantee. The backend never receives the key or the prompts, so it neither stores nor logs them.
4. Acceptable use
You agree not to:
- Use Sextant to access, copy, or analyse repositories you do not have lawful read access to via GitHub.
- Probe, scan, or attempt to break the backend, bypass rate limits, or exfiltrate cached data belonging to other users.
- Submit credentials you do not own, or credentials for accounts you do not have the right to use.
- Use Sextant in any way that violates GitHub's Terms of Service or Acceptable Use Policies.
- Resell or sublicense the Service, or run it for the benefit of unrelated third parties without permission.
- Use automated clients or scripts to send a volume of requests that would degrade Service availability for other users.
We may rate-limit, throttle, or refuse requests that we judge to violate these restrictions. Repeated or material violations may result in your IP address or GitHub login being blocked from the backend.
5. Service availability and changes
Sextant is provided as a free service. We make no guarantees of uptime, response time, or continued availability. We may change features, add features, deprecate features, restrict access, or shut the service down entirely at any time, with or without notice. We will make a reasonable effort to give advance notice at knaxly.dev/sextant of any planned discontinuation.
The hosted backend runs on best-effort consumer-grade cloud infrastructure (Microsoft Azure Container Apps). It may be unavailable, slow, or return errors during maintenance, incidents, or beyond your control.
6. Intellectual property
The "Sextant" name and the sextant logo are reserved by Knaxly Ltd; you may use them to refer to the Service but not to brand a derivative product without permission.
Nothing in these terms grants you any rights in third-party material accessed through Sextant. Repositories, code, and content remain owned by their respective rights-holders, and you must continue to comply with the licences under which that material is made available.
7. Third-party services
Sextant interacts with third-party services that have their own terms. By using Sextant you also agree to comply with the terms of those services where applicable:
- GitHub: Terms of Service. Sextant uses GitHub's REST API and clone endpoints under your own credentials.
- codetabs.com: Sextant sends only the
owner/repostring, and only for a repository it has established is public; see codetabs.com for their policy. - Anthropic: used only when you enable the AI features and supply a key. Content you send is subject to Anthropic's commercial terms (API use is billed to your own key) and their privacy policy, and to the settings on your own Anthropic account.
- osv.dev: the dependency vulnerability check sends package names, ecosystems and versions from your manifests to the Open Source Vulnerabilities API. No code and no token is sent.
- Microsoft (Azure): backend hosting. Microsoft's Online Services Terms apply to their handling of any data transiting their infrastructure.
8. Privacy
Your use of Sextant is also governed by our privacy policy, which describes what data is collected, where it is sent, and how long it is retained. By using Sextant you consent to the data practices described there.
9. Disclaimer of warranties
The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted operation. We do not warrant that the Service will be error-free, that line-of-code counts, repo health signals, dependency vulnerability results, or pull-request risk flags will be accurate, or that the Service will be available at any particular time.
AI output is generated by a third-party model and may be wrong, incomplete, or misleading. Do not rely on it as a security review, a licence review, or authoritative advice about your code. Vulnerability data comes from osv.dev and reflects only what that database knows; an empty result is not evidence that your dependencies are safe.
10. Limitation of liability
To the maximum extent permitted by law, Knaxly Ltd and its contributors shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or use, arising out of or in connection with the Service, whether based on contract, tort (including negligence), strict liability, or any other legal theory, even if we have been advised of the possibility of such damages.
Where liability cannot be excluded under applicable law, our total cumulative liability to you for all claims arising out of or relating to the Service shall not exceed £0 (zero pounds), reflecting the fact that Sextant is provided to you free of charge.
11. Indemnification
You agree to defend, indemnify, and hold harmless Knaxly Ltd and its contributors from any claim, loss, or expense (including reasonable legal fees) arising out of your use of the Service, your violation of these terms, or your violation of any third party's rights, including but not limited to your use of GitHub credentials for repositories you are not authorised to access.
12. Termination
You may stop using Sextant at any time by uninstalling the extension and revoking the OAuth grant or PAT. We may suspend or terminate your access to the backend at any time if we believe you have violated these terms or for any other reason at our discretion.
Sections 6 (Intellectual property), 9 (Disclaimer), 10 (Limitation of liability), 11 (Indemnification), 13 (Governing law) and 14 (Changes) survive termination.
13. Governing law and jurisdiction
These terms are governed by the laws of England and Wales, without regard to its conflict of laws provisions. Any dispute arising out of or in connection with these terms shall be subject to the exclusive jurisdiction of the courts of England and Wales. If you are a consumer, you retain the protections of the mandatory consumer law of your country of residence.
14. Changes to these terms
We may revise these terms from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be announced at knaxly.dev/sextant. Your continued use of the Service after a revision takes effect constitutes acceptance of the new terms; if you do not accept them, stop using the Service.
15. Contact
Operator: Knaxly Ltd. For questions, bug reports, or notices under these terms, use the feedback page at knaxly.dev/sextant/feedback.html, which routes to the public issue tracker at github.com/knaxly-dev/sextant-feedback. Filing needs a GitHub account, and the tracker is public.
Security vulnerabilities must not be reported through the public tracker. Report them privately at github.com/knaxly-dev/sextant-feedback/security/advisories/new, which opens a draft advisory visible only to you and to us. A written contact address is listed in section 16.
16. Company details
Sextant is operated by Knaxly Ltd, a privately owned company registered in the United Kingdom.
- Registered company name: Knaxly Ltd
- Company registration number: 17403507
- Place of registration: England and Wales
- Registered office: 103 Byewaters, Watford, WD18 8WH, United Kingdom
- Contact email: ncr@knaxly.com