This page runs entirely in your browser and talks to the GitHub REST API directly. The token is kept in memory for this tab only: it is never stored and never sent anywhere but api.github.com.