============================================================
PRIVACY POLICY & PERMISSIONS ANALYSIS: PoE Trade Companion
============================================================
Effective Date: October 11, 2026
Last Updated: October 11, 2026
------------------------------------------------------------
1. INTRODUCTION & CORE PRINCIPLE
------------------------------------------------------------
PoE Trade Companion ("the Extension") is committed to respecting and protecting your privacy. We believe that gaming companion tools must be transparent, lightweight, and completely private.
Our guiding principle is simple:
• Zero Personal Data Collection: We do not collect, transmit, store, or sell any personal or sensitive user information.
• 100% Local Processing: All data created by you (such as trade bookmarks, custom folders, currency calculator preferences, and item watchers) is stored exclusively on your local device.
• No External Tracking: The Extension contains zero telemetry, analytics SDKs, advertising scripts, or third-party tracking beacons.
------------------------------------------------------------
2. DATA COLLECTION & STORAGE PRACTICES
------------------------------------------------------------
A. Information You Provide / Create:
• Search Bookmarks: URLs of trade searches that you choose to save and the names you give them.
• Folder Structure: Names and hierarchy of folders you create to organize your searches.
• Preferences & Settings: Selected game league, custom currency exchange ratios, and UI toggles.
• Item Watchers: Titles, search URLs, price thresholds, and check intervals for items you wish to track.
B. Where Is This Information Kept?
All the information listed above is stored exclusively inside your browser using the Chrome Local Storage API (`chrome.storage.local`). It never leaves your browser and is never uploaded to any remote server or third party. You can export or delete this data at any time via the extension's Settings tab.
C. External Network Requests:
The Extension initiates external network requests strictly to:
1. `https://poe.ninja`: To retrieve public currency exchange rates (e.g., Divine Orb to Chaos Orb ratio) when you click the "Sync Rates" button or refresh the currency tab. No personal identifiers or query parameters containing personal information are transmitted.
2. Direct navigation to `https://www.pathofexile.com/trade`: When you click an "Open" or "Live" button on a saved bookmark, your browser navigates to that public trade URL just as if you clicked any bookmark link.
------------------------------------------------------------
3. DETAILED EXPLANATION OF REQUIRED PERMISSIONS
------------------------------------------------------------
To provide its functionality, the Extension requests the following specific permissions:
1. "storage"
• Why it is needed:
Enables the extension to save your custom bookmark folders, trade search links, completion checkmarks, currency exchange overrides, and user settings between browser restarts. Without this, all your saved searches would vanish every time you close the popup or restart Chrome.
2. "notifications"
• Why it is needed:
Enables the extension to show native system desktop notifications when a trade watcher identifies a listed item meeting your criteria (such as a cheap snipe or specific price point), allowing you to respond while in-game without having to constantly watch your browser.
3. "alarms"
• Why it is needed:
Under Chrome Manifest V3, background service workers automatically enter an idle/sleep state to save RAM and CPU. The Chrome Alarms API allows the extension to wake up briefly at user-specified intervals (e.g., every 3 or 5 minutes) to perform watcher checks safely without running high-power background loops.
4. "sidePanel"
• Why it is needed:
Allows users to dock the Extension directly inside Chrome's native Side Panel next to the Path of Exile trade site, providing side-by-side bookmark navigation without covering the trade search results.
5. Host Permissions ("https://www.pathofexile.com/*", "https://pathofexile.com/*")
• Why it is needed:
Allows the extension's content script to run on official Path of Exile trade pages. This is used solely to:
- Add the floating "⭐ Bookmark Search" button to save current queries in one click.
- Display inline currency conversions (showing Chaos equivalent next to Divine prices).
- Inject helpful database shortcuts (links to PoE Wiki, PoEDB, and Craft of Exile).
6. Host Permissions ("https://poe.ninja/*")
• Why it is needed:
Allows the extension to fetch public, community-standard currency rates to keep your Divine-to-Chaos calculations accurate.
------------------------------------------------------------
4. IN-DEPTH ANALYSIS: ARE ALL THESE PERMISSIONS REALLY NECESSARY?
------------------------------------------------------------
(Evaluating the Principle of Least Privilege)
Yes, every requested permission strictly corresponds to a core user-facing feature, and unnecessary or broad permissions have been deliberately excluded.
Here is an analysis of why each is justified and how excess permissions were avoided:
A. What We Deliberately DO NOT Request:
Many other trade tools historically requested excessive or controversial permissions:
• ❌ NO `<all_urls>` or broad wildcards: We strictly restrict host access to `pathofexile.com` and `poe.ninja`. We cannot and will not access any other website you visit.
• ❌ NO `cookies`: We do not read or touch your session cookies or authentication tokens.
• ❌ NO `webRequest` or `webRequestBlocking`: We do not intercept or inspect your network traffic.
• ❌ NO `tabs` / sensitive tab data permission: We do not track your open tabs, history, or active window contents across the internet.
• ❌ NO Discord API access or token harvesting: We do not interact with your Discord credentials or external chat programs.
B. Why the Included Permissions Cannot Be Further Reduced:
1. Could we remove `storage`?
No. Without `storage`, users could not save bookmarks, folders, or settings. It is the fundamental storage engine for client-side bookmarking.
2. Could we remove `alarms`?
No. Manifest V3 strictly enforces service worker shutdown after ~30 seconds of inactivity. `chrome.alarms` is the official, battery-friendly, and secure mechanism mandated by Google to schedule periodic tasks.
3. Could we remove `notifications`?
The core bookmarking and currency features would work without it, but the "Trade Watchers" feature requires desktop notifications to alert players when an item is found. Without this permission, notifications cannot be shown.
4. Could we remove `sidePanel`?
While the extension also functions as a popup, the side panel was specifically engineered to satisfy community demand for having trade bookmarks open permanently alongside the trade webpage.
5. Could we remove `pathofexile.com` host permissions?
Without host permission on `pathofexile.com`, Chrome prohibits content script injection. This would break inline currency conversion badges, Wiki lookup links, and the one-click bookmark button on trade pages.
6. Could we remove `poe.ninja` host permissions?
Without it, the currency calculator would not be able to fetch live market rates, forcing users to manually calculate or type every exchange rate.
CONCLUSION:
The permission footprint is as minimal, tight, and secure as modern Chrome Manifest V3 allows. Every permission serves a transparent, immediate user benefit with zero excess privilege.
------------------------------------------------------------
5. LIMITED USE DISCLOSURE
------------------------------------------------------------
PoE Trade Companion complies fully with the Chrome Web Store Developer Program Policies, including the Limited Use policy:
1. The Extension's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy.
2. We do not sell, rent, or transfer user data to third parties.
3. We do not use user data for targeted advertising, personalized lending, or creditworthiness evaluations.
4. All data is processed solely for providing and improving the single purpose of the Extension.
------------------------------------------------------------
6. CONTACT & QUESTIONS
------------------------------------------------------------
If you have any questions, feedback, or concerns regarding this Privacy Policy or the security of PoE Trade Companion, please open an issue on our official community repository or reach out via our Chrome Web Store support page.