Placeholder for terms of service and privacy policy. looft stores GitHub tokens encrypted at rest and never exposes them to the browser. Widget access is an origin-bound, short-lived token plus a per-portal origin allow-list.