PRIVACY POLICY FOR NEON'S HITBOX MOD
Last Updated: October 2026
1. INTRODUCTION & CORE PRIVACY COMMITMENT
Neon's Hitbox Mod ("the extension") is an open-source, client-side utility and enhancement suite designed for players of the multiplayer web game Hitbox.io (also hosted on Heav.io). We believe in absolute privacy, user autonomy, and complete transparency.
THE EXTENSION OPERATES 100% LOCALLY IN YOUR BROWSER. WE DO NOT COLLECT, TRANSMIT, LOG, TRACK, SELL, OR SHARE ANY PERSONAL DATA.
2. WHAT INFORMATION DO WE COLLECT?
• Zero Personal Information: We do not collect names, email addresses, IP addresses, browsing histories, passwords, or device identifiers.
• Zero Telemetry or Analytics: There are no third-party tracking scripts, analytics trackers (such as Google Analytics), or remote tracking servers embedded in this extension.
• Zero Account or Game Credential Access: The extension does not access, read, or alter your account passwords or session authentication tokens. All features operate within the active match state in your browser tab.
3. PERMISSIONS BREAKDOWN & WHY THEY ARE USED
The extension declares the absolute minimal set of permissions required to deliver its features:
a) Host Permissions ("https://hitbox.io/*", "https://heav.io/*")
• Purpose: Allows the extension to inject the in-game floating mod menu, render the parkour jump box alignment tool, and enable demo replay recording specifically when you visit Hitbox.io or Heav.io.
• Scope: Strictly limited to https://hitbox.io/* and https://heav.io/*. The extension cannot access, read, or modify any other website or domain you browse.
b) Chrome Storage API ("storage")
• Purpose: Used exclusively to save your chosen preferences locally on your computer (such as whether the Jump Box is turned on, your custom chat macros, staff whitelist, and UI display options).
• Scope: All saved settings remain inside your local browser storage (`chrome.storage.local`). They are never uploaded or transmitted across the network.
4. ARE ALL THESE PERMISSIONS STRICTLY NECESSARY?
Yes. Every permission has been audited according to the Principle of Least Privilege:
• Why Host Permissions instead of activeTab?
The activeTab permission requires the user to manually click the extension icon on every single page load before scripts can run. Because Neon's Hitbox Mod is an in-game HUD that hooks early WebSocket events and canvas rendering at match start, host permission for the specific game domains is the only reliable and seamless method.
• Why specific domains instead of broad URL patterns?
The extension explicitly restricts host permissions to "https://hitbox.io/*" and "https://heav.io/*". Unlike other extensions that request "<all_urls>" or "*://*/*", Neon's Hitbox Mod has zero visibility into any other tabs, pages, or search history.
• Why storage?
Without the local storage permission, any custom macros, banned word filters, or visual toggles you configure would be reset every time you refresh the page. Local storage allows your settings to persist offline on your device without communicating with any external server.
• Absence of High-Risk Permissions:
The extension deliberately avoids requesting sensitive permissions such as "webRequest", "cookies", "identity", "history", "tabs", or external network requests. It cannot intercept network traffic, inspect cookies, or contact external servers.
5. THIRD-PARTY SERVICES & ADVERTISEMENTS
Neon's Hitbox Mod does not serve advertisements, does not bundle third-party SDKs, and does not monetize through data brokers.
6. DATA RETENTION & SECURITY
Because no data is ever transmitted to an external server, there is no database of user information. All gameplay adjustments occur in real-time in your computer's temporary memory (RAM) and disappear once you close the browser tab.
7. CONTACT & INQUIRIES
If you have questions, feedback, or would like to review the extension's source code, please refer to the official documentation page included with the extension.