When you are using our plugin, we are only processing the names of the files and the folder structure where it resides in a GitHub branch which are getting committed as part of Git Pull Request to generate the Salesforce package XML. We are not collecting/processing any other user information.