# PRIVACY POLICY & PERMISSION AUDIT
Extension Name: Forge Hammer - FoE Companion & Tools
Last Updated: October 2026
================================================================================
PART 1: PRIVACY POLICY
================================================================================
1. INTRODUCTION & CORE PRINCIPLE
We respect your privacy. Forge Hammer is designed from the ground up as a client-side companion tool for players of the web game Forge of Empires.
Our fundamental privacy commitment is simple:
• Zero tracking: We do not track your browsing activity, personal identity, or sensitive information.
• Zero external transmission: No user data, game data, or notes are ever uploaded to any external server or third party.
• 100% Local processing: All calculations, timers, notes, and preferences remain exclusively inside your browser on your local device.
2. DATA HANDLING PRACTICES
• In-Game Interactions: The extension provides calculations and a floating quick-access button on Forge of Empires game pages (forgeofempires.com). It does not record your credentials, account passwords, or payment details.
• Notepad Data: Any notes entered in the companion scratchpad are saved via the Chrome local storage API (`chrome.storage.local`) on your machine.
• Timer Data: Active alarms and expiration timestamps are stored locally to maintain countdowns across browser sessions.
• Analytics & Cookies: The extension does NOT use third-party analytics (no Google Analytics, no telemetry, no tracking pixels), and does not set tracking cookies.
3. DATA RETENTION & DELETION
All extension data resides in your browser's local sandbox storage. You can delete all stored preferences, timers, and notepad content at any time by:
1. Clicking "Clear Notes" inside the extension popup, or
2. Removing or uninstalling the extension from `chrome://extensions`.
4. COMPLIANCE WITH POLICIES & GDPR
Under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you have full rights to your data. Since Forge Hammer stores all data locally on your device and does not collect or transmit personal identifiers, you maintain absolute custody and control over your data at all times.
5. CONTACT
For questions or support regarding this policy, please open an issue on the project's repository or contact the extension maintainer via the support link on the Chrome Web Store item page.
================================================================================
PART 2: PERMISSION AUDIT — WHY THEY ARE NEEDED & ARE THEY ALL TRULY NECESSARY?
================================================================================
When publishing a Chrome extension, Google's developer policy mandates requesting the "least privilege" necessary. Below is an honest, technical explanation of each permission requested, why it is used, and an evaluation of whether it is strictly required or can be omitted.
--------------------------------------------------------------------------------
1. "storage"
--------------------------------------------------------------------------------
• What it does: Grants access to `chrome.storage.local`.
• Why it is used: Keeps your customized Arc boost multiplier (e.g., 1.90x vs 1.92x), active timer lists, local notepad notes, and sound preferences intact when you close the popup or restart Chrome.
• Is it strictly necessary?
-> YES. Without local storage, every time you close the extension popup, your notes, custom calculator rates, and active alarms would be wiped out. It is lightweight and does NOT trigger any warning during installation.
--------------------------------------------------------------------------------
2. "alarms"
--------------------------------------------------------------------------------
• What it does: Grants access to the `chrome.alarms` API.
• Why it is used: In modern Chrome Extensions (Manifest V3), the background script (service worker) is terminated after approximately 30 seconds of inactivity to save RAM. The `chrome.alarms` API is the only reliable way in MV3 to wake up the service worker when a timer (like a 4-hour GBG sector cooldown or an 8-hour production) finishes.
• Is it strictly necessary?
-> YES (for background reminders). Without `alarms`, timers would stop counting as soon as the service worker goes to sleep or the browser tab is idle. It does NOT trigger any warning during installation.
--------------------------------------------------------------------------------
3. "notifications"
--------------------------------------------------------------------------------
• What it does: Allows the extension to display native OS/Chrome desktop alerts.
• Why it is used: When a countdown alarm expires, a notification popup (e.g., "GBG Sector Lock Expired!") appears on your screen even if you are working in another app or browsing a different tab.
• Is it strictly necessary?
-> HIGHLY RECOMMENDED for timer UX. Technically, if you only want in-popup visual countdowns and sound alerts while the tab is active, you could omit desktop notifications. However, for a reminder/alarm tool, players expect desktop notifications so they don't miss battleground lock openings.
--------------------------------------------------------------------------------
4. "clipboardWrite"
--------------------------------------------------------------------------------
• What it does: Allows writing plain text to the user's system clipboard upon a user click.
• Why it is used: Enables the 1-click "Copy Spot List to Clipboard" button in the 1.9x calculator. This lets players instantly copy formatted spot strings (e.g., "The Arc P1(950) P2(475) P3(162)") to paste directly into their guild message threads.
• Is it strictly necessary?
-> PRACTICALLY YES (for smooth UX). Without this permission, the user would have to manually highlight text in a field and press Ctrl+C / Cmd+C manually. The permission is safe because it only triggers upon direct user interaction (clicking the copy button).
--------------------------------------------------------------------------------
5. "host_permissions": ["https://*.forgeofempires.com/*"]
--------------------------------------------------------------------------------
• What it does: Restricts content script injection exclusively to official Forge of Empires game domains.
• Why it is used: Injects the floating in-game HUD helper button on the Forge of Empires screen so players can calculate contribution values without switching away from the game.
• Is it strictly necessary?
-> YES, for the in-game overlay features. It is strictly scoped only to `*.forgeofempires.com`, ensuring the extension has zero access to any other website you visit.
--------------------------------------------------------------------------------
PERMISSIONS AVOIDED / NOT NEEDED:
--------------------------------------------------------------------------------
• "tabs" / "activeTab":
Neither is required! Older extensions often requested `"tabs"`, which causes Chrome to display a severe warning on installation: "Read your browsing history".
Because `chrome.tabs.create()` (used to open pages) requires no permissions, and checking game tabs is covered by `host_permissions`, neither `"tabs"` nor `"activeTab"` is needed. Avoiding them ensures 0 privacy warnings during installation!
================================================================================
SUMMARY: PERMISSION EFFICIENCY SCORE
================================================================================
By completely omitting the `"tabs"` permission and strictly scoping host permissions to `*.forgeofempires.com`, this extension achieves the cleanest possible permissions profile. It delivers full functionality (1.9x calculator, background alarms, notifications, clipboard copying, and in-game HUD) without raising security alarms during Chrome Web Store review.