-
Notifications
You must be signed in to change notification settings - Fork 0
Privacy Policy ‐ FPN Reader
FPN Reader is built around a single rule: it only ever talks to
www.fountainpennetwork.com. This document states plainly what that means
and what it doesn't.
Nowhere but the forum. The extension's host_permissions covers exactly
https://www.fountainpennetwork.com/* and nothing else. There is no
analytics service, no telemetry, no crash/error reporter, no CDN, no font
host, and no third-party API of any kind. Every network request the
extension itself makes — fetching a thread, an avatar, an attachment,
posting a reply — goes to that one origin, same as if you'd typed the URL
into the address bar yourself.
The one other place network traffic is touched at all is the
declarativeNetRequest ruleset, and it only ever blocks — it stops your
browser from talking to a handful of third-party ad and tracking hosts
(and to FPN's own chatbox poll) that the native page would otherwise load.
Blocking a request is not the same as sending one; nothing is contacted as a
result of that ruleset existing.
The extension does not request the cookies permission and never reads
document.cookie. This isn't an oversight — it's deliberate. The reader's
same-origin fetch() calls run from the content script in the page's own
context, so your session cookie rides along automatically the same way it
would for any other request the page makes; the extension itself never has
a way to see, copy, or transmit that cookie, because it never asks for the
permission that would let it.
The one other credential involved is the CSRF token IPS requires to submit a
post. That token is read from the live page at the moment you hit reply, held
in memory for exactly that one request, and never written to
storage.local, storage.sync, IndexedDB, or any log. It does not persist
between posts and it does not survive a page reload.
Pages and images you view through the reader are cached locally (in IndexedDB) so re-reading them doesn't cost another request. That cache is partitioned by account — a guest (logged-out) partition, and a separate partition per member ID. A record written under one partition is never readable from another, so a members-only thread you read while logged in can't leak to a guest view, and content from one account can't surface under a different one on a shared computer.
Private areas of the site are never cached, prefetched, or handled by the
reader at all. Messenger, notifications, account settings, your profile
editor, login, registration, password reset, the moderator CP, the admin CP,
and any URL carrying a csrfKey parameter are left entirely to native IPS —
the reader doesn't intercept those links, doesn't fetch them in the
background, and doesn't store anything from them. If a URL even looks like
it might fall into one of those categories, it's treated as private.
One deliberate, narrow exception, stated plainly: member avatars are
served from /forum/uploads/profile/…, which contains the word "profile" but
is an ordinary public image directory, not your profile page. Those thumbnails
are fetched and cached like any other picture on the forum, because otherwise
no avatar could ever be displayed. Nothing else under any /profile/ path is
fetched, cached, or rendered — your profile page and profile editor remain
completely untouched, and the exception is written narrowly enough that it
cannot match a page, a URL with a query string, or anything carrying a token.
If you save a reply as a draft before sending it, that draft is stored locally under your account's partition and is cleared automatically the moment the reply posts successfully.
Everything the extension stores lives on your device, in your browser's
extension storage. The extension writes only to storage.local and IndexedDB,
both of which are device-local; it never writes to storage.sync, which is the
only storage area browsers replicate to your account. Nothing it stores leaves
your machine. The toolbar popup shows how much is
cached (pages, assets, bytes) and has a Clear stored data action that
wipes all of it — cached pages, cached assets, and any saved drafts —
immediately.
- No
eval, nonew Function, no remotely loaded code. The extension's content security policy isscript-src 'self'; object-src 'self'— everything that runs shipped in the extension package you installed. - Post content from the server is treated as untrusted and passed through a strict allowlist sanitizer before anything is rendered; raw server HTML is never inserted into the page.
- Images in posts are not fetched automatically. They render as a placeholder stating the request cost, and only load when you (or the "load images automatically" setting) ask for them — so nothing embedded in a post gets fetched without a choice being made first.
If any of the above stops being true, that's a bug against this document, not an intended change — the design goal is zero egress beyond the one site this extension exists to help you read.