Skip to content

PRIVACY.md

Latest commit

 

History

History
430 lines (303 loc) · 12.8 KB

PRIVACY.md

File metadata and controls

430 lines (303 loc) · 12.8 KB

Privacy Policy for FireFlag

Last Updated: February 4, 2026 Effective Date: February 4, 2026 Version: 1.0.0

Introduction

FireFlag is a Firefox browser extension that helps users safely manage browser flags (about:config settings, experimental features, and developer flags). This privacy policy explains what data FireFlag collects, how it's used, and your rights regarding your data.

TL;DR: FireFlag stores all data locally on your device. We do not collect, transmit, or share any personal information. We do not use analytics, tracking, or telemetry.

Developer Information

Data Collection and Storage

What Data is Stored Locally

FireFlag stores the following data locally on your device only using Firefox's browser.storage API:

  1. Flag States

    • Which flags you have enabled/disabled
    • Current flag values
    • Last modified timestamps

  2. Change History (if tracking enabled)

    • Before/after values when you toggle flags
    • Timestamps of changes
    • Performance metrics at time of change

  3. User Preferences

    • Auto-update settings
    • UI preferences (compact view, safety badges, etc.)
    • Permission grants
    • Export format preferences

  4. Flag Database

    • Local copy of the flag database (105+ Firefox flags)
    • Flag metadata (descriptions, safety levels, effects)
    • Version information

Storage Location: All data is stored using browser.storage.local API, which keeps data on your device in Firefox's profile directory.

What Data is NOT Collected

FireFlag does NOT collect, store, or transmit:

  • ❌ Personal identifying information (name, email, IP address)
  • ❌ Browsing history or website URLs
  • ❌ Search queries or form data
  • ❌ Cookies or authentication tokens
  • ❌ System information (OS, hardware specs)
  • ❌ Analytics or telemetry data
  • ❌ Crash reports or error logs
  • ❌ User behavior patterns
  • ❌ Any data that leaves your device

Network Activity

Automatic Database Updates

When auto-update is enabled (default), FireFlag checks for database updates:

You can disable auto-updates in Settings → General → Auto-Update.

Manual Database Updates

When you manually check for updates:

  • Same process as automatic updates
  • Triggered by user action only
  • Can be disabled entirely

No Analytics or Tracking

FireFlag does NOT:

  • Use Google Analytics or similar services
  • Track user behavior
  • Send telemetry data
  • Phone home for any reason except database updates
  • Include third-party scripts or trackers

Permissions and Data Access

Required Permissions

FireFlag requests these Firefox permissions:

  1. storage (Required)
    • Purpose: Store flag states and user preferences locally
    • Data Access: Your flag configurations and settings
    • Scope: Local device only

Optional Permissions

These permissions are requested only when you enable specific flags:

  1. browserSettings (Optional)

    • Purpose: Modify browser settings when you enable certain flags
    • Requested When: You toggle a flag affecting browser settings
    • Can Be Revoked: Yes, anytime in Firefox permissions

  2. privacy (Optional)

    • Purpose: Modify privacy-related flags
    • Requested When: You toggle a privacy flag
    • Can Be Revoked: Yes, anytime

  3. tabs (Optional)

    • Purpose: Display active flags in DevTools panel
    • Requested When: You open DevTools panel
    • Data Access: Current tab URL (not stored or transmitted)
    • Can Be Revoked: Yes, anytime

  4. notifications (Optional)

    • Purpose: Show notifications for database updates
    • Requested When: You enable update notifications
    • Can Be Revoked: Yes, anytime

  5. downloads (Optional)

    • Purpose: Export flag reports as JSON/CSV
    • Requested When: You export data
    • Can Be Revoked: Yes, anytime

Permission Transparency

FireFlag implements granular permission requests:

  • Permissions are requested only when needed
  • Each permission shows what it enables
  • You can review and revoke permissions anytime
  • The extension explains why each permission is requested

Data Sharing and Third Parties

No Data Sharing

FireFlag does NOT share your data with:

  • ❌ Third-party services
  • ❌ Analytics providers
  • ❌ Advertising networks
  • ❌ Data brokers
  • ❌ The developer (us)
  • ❌ Mozilla (except standard extension metadata)

Third-Party Services Used

FireFlag interacts with these external services:

  1. GitHub (for database updates)

  2. Mozilla Add-ons (for extension updates)

Note: FireFlag does not control these third-party services. Please review their privacy policies.

Data Retention

Local Data

  • Stored: Until you uninstall the extension or clear Firefox data
  • Deletion: Automatically deleted when extension is removed
  • Manual Deletion: Settings → Clear All Data button

Exported Data

When you export flag reports:

  • Stored: On your device in Downloads folder
  • Retention: Your responsibility to delete
  • Content: Flag states, change history, performance metrics (no personal data)

Your Privacy Rights

Access and Control

You have complete control over your data:

  1. View Data

    • Open DevTools → Application → Storage → Extension Storage
    • View all stored flag states and preferences

  2. Export Data

    • Sidebar → Export tab → Download as JSON/CSV
    • Portable format you can review

  3. Delete Data

    • Per-flag: Click "Reset to Default"
    • All data: Settings → Advanced → Clear All Data
    • Complete removal: Uninstall extension

  4. Manage Permissions

    • Firefox → Add-ons → FireFlag → Permissions
    • Revoke any optional permission

No Account Required

FireFlag does NOT require:

  • Account creation
  • Registration
  • Login credentials
  • Email address
  • Personal information

GDPR Compliance (EU Users)

FireFlag complies with GDPR because:

  1. No Personal Data Processing

    • All data stored locally
    • No profiling or automated decision-making
    • No data transfer outside EU (all local)

  2. Data Minimization

    • Only essential data stored
    • No excessive data collection

  3. User Control

    • Full access to your data
    • Easy export and deletion
    • Transparent processing

  4. No Consent Required

    • GDPR requires consent for personal data processing
    • FireFlag doesn't process personal data
    • All storage is local and user-initiated

Your GDPR Rights

Even though FireFlag doesn't collect personal data, you have these rights:

  • ✅ Right to Access: View all data in browser storage
  • ✅ Right to Rectification: Edit flag states anytime
  • ✅ Right to Erasure: Delete all data or uninstall
  • ✅ Right to Data Portability: Export as JSON/CSV
  • ✅ Right to Object: Disable features or uninstall

CCPA Compliance (California Users)

FireFlag complies with CCPA:

  1. No Sale of Personal Information

    • FireFlag does NOT sell personal information
    • We don't collect personal information to sell

  2. No Sharing with Third Parties

    • All data stays on your device
    • No third-party data sharing

  3. Opt-Out Rights

    • Not applicable (no data collection to opt out of)
    • Can disable all network activity (auto-updates)

Children's Privacy

FireFlag does not:

  • Target children under 13
  • Knowingly collect data from children
  • Require age verification (no accounts)

FireFlag is safe for all ages because it collects no personal data.

Data Security

Local Storage Security

  • Encryption: Firefox encrypts browser.storage data
  • Access Control: Only FireFlag can access its storage
  • Isolation: Separate from other extensions and websites

Code Security

  • Open Source: All code publicly auditable on GitHub
  • Security Scanning: Automated security analysis (Svalin, Vordr, Selur)
  • No Minification: Source code is readable
  • Reproducible Builds: Verifiable build process

No Server-Side Risk

  • No Backend: No servers to hack
  • No Database: No central storage to breach
  • No Cloud: Nothing stored in the cloud
  • Local Only: All data on your device

Changes to Privacy Policy

Notification of Changes

We will notify you of privacy policy changes by:

  1. Updating the "Last Updated" date at the top
  2. Publishing changes on GitHub
  3. Including in extension update notes (for major changes)

Material Changes

If we make material changes (e.g., start collecting data):

  • We will request new permissions
  • Firefox will prompt you to approve
  • You can decline and continue using the old version

Version History

Privacy policy versions are tracked on GitHub: https://github.com/hyperpolymath/fireflag/commits/main/PRIVACY.md

Open Source Transparency

FireFlag is fully open source:

Build Reproducibility

FireFlag uses reproducible builds:

  • Anyone can verify the published extension matches the source code
  • Build instructions in repository
  • No hidden code or telemetry

Contact and Questions

Privacy Questions

For privacy-related questions:

Data Requests

To exercise your privacy rights (though not needed for local data):

  • Access: Use DevTools or export feature
  • Deletion: Use "Clear All Data" or uninstall
  • Questions: Email above address

Security Vulnerabilities

To report security issues:

  • Email: j.d.a.jewell@open.ac.uk (GPG key available on request)
  • GitHub: Security tab (private disclosure)
  • Bug Bounty: None currently

Mozilla Add-ons Privacy

FireFlag is distributed through Mozilla Add-ons:

Mozilla may collect:

  • Extension installation/update events
  • Crash reports (if Firefox crash reporting enabled)
  • General usage statistics (opt-in)

This is separate from FireFlag - we don't receive this data.

Commitment to Privacy

Our Promise:

  1. We will never collect personal data
  2. We will never sell or share your data
  3. We will never add analytics or tracking
  4. We will always store data locally
  5. We will always be transparent about changes

If we ever violate these promises:

  • We will immediately notify all users
  • We will request new permissions
  • You can decline and keep using the old version
  • You can report violations to Mozilla

Legal Basis (GDPR)

FireFlag's data processing is based on:

  • Legitimate Interest: Provide extension functionality
  • User Consent: Explicit permission grants for optional features
  • Contract Performance: Not applicable (no terms of service)

Since all processing is local and user-initiated, no additional legal basis is required.

International Data Transfers

Not applicable - all data stored locally on your device.

Automated Decision-Making

FireFlag does NOT use:

  • Profiling
  • Automated decision-making
  • Machine learning on user data
  • Behavioral analysis

License

This privacy policy is licensed under CC BY-SA 4.0: https://creativecommons.org/licenses/by-sa/4.0/

You may share and adapt this policy with attribution.

Last Updated: February 4, 2026 Effective Date: February 4, 2026 Version: 1.0.0

FireFlag Privacy Policy Copyright (C) 2026 Jonathan D.A. Jewell Licensed under CC BY-SA 4.0