Privacy

nbview renders notebooks in your browser. There is no nbview server that receives them, nothing to sign up for, and no cookie banner, because there is nothing to consent to.

What stays in this browser

These are kept in your browser’s local storage and are never sent to nbview:

• A GitHub token, if you saved one. It is sent only to api.github.com, and only to read the repositories you point nbview at. It never goes to raw.githubusercontent.com, and never to a host that a notebook loads something from.
• Your recently opened list, and your GitHub account name once you sign in, so the next visit can show them without asking GitHub again.
• Your light or dark choice, applied before the first paint.

Folder listings are also cached for five minutes per tab, so going back to a folder you just viewed does not spend GitHub’s hourly limit. That cache goes away with the tab.

To drop the token, open Private repos in the top bar and choose Remove token. To drop everything, clear site data for nbview.org in your browser: there is no copy anywhere else.

What leaves the browser, and where it goes

• GitHub. Folder listings and private notebooks go to api.github.com; public notebook files come from raw.githubusercontent.com. GitHub sees your IP address and, on API calls, your token.
• Images inside a notebook are held back unless they come from GitHub’s own file hosts. Anything else is shown as Image from example.com with a Show button, and is fetched only when you click it, without a Referer, so that host learns neither your address nor which notebook you are reading.
• Interactive Plotly charts run in a frame the browser isolates from this page: no access to your token, storage or cookies, and no network.

Files you choose from your disk are read in the page and never uploaded anywhere.

What nbview.org records

nbview has no server of its own: the site is static files served by Cloudflare. Cloudflare’s privacy-focused analytics count page views, with no cookies.

The only cookie nbview sets is a sign-in cookie, limited to /auth, that lasts ten minutes and is removed when GitHub sends you back. If you never sign in, nbview sets no cookie at all.

What nbview counts

The viewer routes on the address fragment, so a page-view counter cannot see a notebook being opened: ten notebooks read in one tab are one page view. So the page tells this site’s own /count endpoint what happened, using one of three words:

• open when a notebook is rendered;
• compare when a comparison is shown;
• embed when a notebook is opened inside an embed.

One word, and nothing else: no notebook, no repository, no address, no user agent, no timestamp.

Each request moves a single number, and that number is all nbview stores: no row per visit, no cookie, nothing that could follow you between pages, notebooks or visits. Cloudflare serves the request the way it serves any other request to this site. The three totals are public: anyone can read them at /count. Counting is skipped entirely when your browser sends Do Not Track or Global Privacy Control.

On a deployment with no counter storage configured, the endpoint answers and records nothing.

Signing in with GitHub

Signing in asks GitHub for a token. The one step that touches a server is swapping GitHub’s one-time code for that token; the token is then stored in your browser, not on a server. Signing out revokes it with GitHub.

Questions, and security reports

Security problems: see security.txt. Anything else: open an issue on GitHub.

Written to be read, not to be survived. Open the viewer, read the two guides on opening a notebook from GitHub and comparing two notebooks, or see what changed.