PRIVACY POLICY & PERMISSION TRANSPARENCY REPORT
================================================================================
Extension Name : MooMoo.io Autoheal + Numpad Hat Mod
Current Version: 1.0.0
Effective Date : October 2026
Architecture : Manifest V3, 100% Client-Side Execution
1. COMMITMENT TO USER PRIVACY
--------------------------------------------------------------------------------
MooMoo.io Autoheal + Numpad Hat Mod was built with a strict privacy-first philosophy. We firmly believe browser tools and game modifications should enhance player experience without collecting, tracking, harvesting, or transmitting private user data.
This extension:
• DOES NOT collect, record, or transmit personal identity information (PII).
• DOES NOT track your browsing history or visited tabs.
• DOES NOT communicate with any external analytics, telemetry, or advertising servers.
• DOES NOT use cookies or remote trackers.
• Operates completely offline/locally within the active MooMoo.io browser tab.
2. DETAILED BREAKDOWN OF REQUESTED PERMISSIONS
--------------------------------------------------------------------------------
To function correctly, the extension declares only two permissions in its manifest.json:
A. Host Permissions ("*://moomoo.io/*", "*://*.moomoo.io/*", "*://dev.moomoo.io/*", "*://sandbox.moomoo.io/*")
• Purpose: Allows the extension's content script to be injected into official MooMoo.io game pages.
• Operation: The script intercepts the client-side game WebSocket messages to monitor player health points (packet type "10") and automatically trigger the food consumption packet when damage is sustained. It also communicates hat purchase/equip commands to the game.
• Scope: Restricted strictly to MooMoo.io domains. The extension cannot run on, view, or interact with any other website you visit.
B. "storage"
• Purpose: Used exclusively to save user-customized preferences in Chrome's local storage (chrome.storage.local).
• Data stored:
- Autoheal Enabled status (true/false)
- Reaction Delay (e.g., 167 ms)
- In-Game HUD visibility state (true/false)
- Laptop mode key toggle (true/false)
- Sound alerts toggle (true/false)
• Storage location: Saved entirely on your local computer. This data never leaves your device.
3. ARE ALL THESE PERMISSIONS TRULY NECESSARY? (AUDIT & MINIMAL PRIVILEGE ANALYSIS)
--------------------------------------------------------------------------------
YES. Every declared permission has been subjected to a strict security audit to ensure full compliance with the Chrome Web Store's Principle of Least Privilege. Here is why each permission is essential and why no excess permissions exist:
Q1: Can we remove the Host Permissions?
Answer: NO.
MooMoo.io is a web-based HTML5 canvas game that relies on real-time binary WebSockets. Without host permissions for moomoo.io, Chrome will block the extension from injecting the content script (`content_main.js` and `lib/msgpack5.min.js`). Without this script running in the game tab, it is technically impossible to inspect incoming damage packets, calculate health drops, or send hat equip requests. Host permissions are scoped strictly to moomoo.io domains and never touch external websites.
Q2: Can we remove the "storage" permission?
Answer: NO (unless user settings are discarded on every tab reload).
Without the "storage" permission, any time you close the popup, reload the game, or restart your browser, all your custom reaction delay timings, HUD placement, and hotkey preferences would be reset to factory defaults. "storage" stores only simple numerical and boolean configuration flags locally.
Q3: Are dangerous or broad permissions used?
Answer: ABSOLUTELY NOT.
• NO "<all_urls>" or broad wildcard web access.
• NO "tabs" permission (which would allow reading tab URLs or titles across your browser).
• NO "activeTab" permission redundancy (since host permissions already cover moomoo.io, adding activeTab would be unnecessary clutter).
• NO "webRequest" or "declarativeNetRequest" permissions.
• NO "cookies" permission.
• NO "scripting" permission (declarative content scripts are used instead).
• NO remote code loading or external CDN scripts (msgpack5 is bundled locally inside the extension package, satisfying strict Manifest V3 security rules).
4. THIRD-PARTY DATA DISCLOSURE
--------------------------------------------------------------------------------
We do not sell, trade, rent, or transfer any user data to third parties. There are no marketing SDKs, tracking pixels, or monetized data-collection routines included in this software.
5. USER CONTROLS AND REMOVAL
--------------------------------------------------------------------------------
You maintain complete control over the extension at all times:
• You can toggle Autoheal, HUD visibility, and sound alerts on or off in real time from the popup or via in-game hotkeys ([T] and [H]).
• You can clear stored preferences at any time by clearing extension data in your browser settings.
• You can disable or uninstall the extension with a single click via `chrome://extensions`. Removal immediately and permanently deletes all stored local settings.
6. CONTACT & TRANSPARENCY
--------------------------------------------------------------------------------
If you have any questions regarding this Privacy Policy or wish to inspect the extension's source code, all files are packaged transparently in your browser's extension directory.