Present the repo as a scoped bookmarks API product and drop homelab-only notes.

2026-09-22 08:10:02 -04:00
parent c19e619b2f
commit cfda629418
10 changed files with 123 additions and 45 deletions
@@ -0,0 +1,23 @@
+# Privacy
+
+Bookmarks API for Scripting and AI runs on your computer. It does not send your bookmarks, secrets, or browsing data to the authors or to any remote service.
+
+## What it can see
+
+With the `bookmarks` permission, the add-on can read and change bookmarks in the Firefox profile where it is installed. That is the product. Local scripts you authorize can request the same operations through the loopback API.
+
+## What it stores
+
+Manage clients stores **SHA-256 hashes** of issued secrets, plus the client name and timestamps, in `browser.storage.local`. The plaintext secret is shown once and is not kept.
+
+The add-on does not use `storage.sync`, so those hashes are not uploaded with a Firefox Account.
+
+## What it does not collect
+
+No telemetry, crash reports, or analytics. No account. No network calls to the authors.
+
+The optional native host listens on `127.0.0.1` only so *your* local tools can reach the add-on. It does not accept browser-origin requests.
+
+## Revoking access
+
+Toolbar → **Manage clients** → **Revoke**. After that, the old secret is rejected.