# Privacy

Bookmarks API for Scripting and AI runs on your computer. It does not send your bookmarks, secrets, or browsing data to the authors or to any remote service.

## What it can see

With the `bookmarks` permission, the add-on can read and change bookmarks in the Firefox profile where it is installed. That is the product. Local scripts you authorize can request the same operations through the loopback API.

## What it stores

Manage clients stores **SHA-256 hashes** of issued secrets, plus the client name and timestamps, in `browser.storage.local`. The plaintext secret is shown once and is not kept.

The add-on does not use `storage.sync`, so those hashes are not uploaded with a Firefox Account.

## What it does not collect

No telemetry, crash reports, or analytics. No account. No network calls to the authors.

The optional native host listens on `127.0.0.1` only so *your* local tools can reach the add-on. It does not accept browser-origin requests.

## Revoking access

Toolbar → **Manage clients** → **Revoke**. After that, the old secret is rejected.