================================================================================
PRIVACY POLICY & PERMISSION AUDIT: CUSTOM MODS FOR KIRKA.IO
================================================================================
Last Updated: October 2026
1. INTRODUCTION & CORE PHILOSOPHY
Custom Mods for Kirka.io ("the Extension") is committed to absolute user privacy and data security. The extension is built as a strictly client-side game enhancement utility for players of Kirka.io. We operate under a strict zero-data-collection philosophy: we do not collect, transmit, store, monetize, or share any personal information, browsing history, or behavioral metrics.
2. INFORMATION WE DO NOT COLLECT
• No Personal Identifiable Information (PII): We do not collect names, email addresses, IP addresses, physical locations, or device identifiers.
• No Account Credentials: We do not intercept, read, or access your Kirka.io login credentials, passwords, or authentication tokens.
• No Web Browsing History: We do not track or monitor pages visited outside of or within Kirka.io.
• No Analytics or Third-Party Trackers: There are no Google Analytics, telemetry beacons, or third-party advertising SDKs bundled into this extension.
• No External Network Calls: The extension operates entirely within your browser and never sends outbound requests to external servers.
3. DATA STORED LOCALLY
The only data processed by the extension consists of player gameplay configuration presets stored strictly on your local computer via Chrome's native `chrome.storage.local` API. This data includes:
- Toggle states (e.g., Wallhack enabled/disabled, AutoJump enabled/disabled).
- Numerical slider settings (e.g., jump interval in ms, speed multiplier, fire rate factor).
- Interface preferences (e.g., HUD visibility, audio tone feedback).
This data remains exclusively on your device and can be erased at any time by clicking "Reset to Defaults" in the popup menu or uninstalling the extension.
--------------------------------------------------------------------------------
4. DETAILED BREAKDOWN OF REQUESTED PERMISSIONS
--------------------------------------------------------------------------------
The Extension requests only two permissions in its manifest.json:
A. "storage" Permission
• What it does: Grants access to Chrome's local extension storage API (`chrome.storage.local`).
• Why it is required: Allows the extension to remember your custom slider intervals, toggles, and hotkey states between browser sessions so you do not need to reconfigure them every time you open Kirka.io.
• Security Profile: Highly secure; reads/writes only local configuration key-value pairs.
B. Host Permission: "https://kirka.io/*"
• What it does: Restricts extension script execution strictly and exclusively to the domain "https://kirka.io/*".
• Why it is required: Required to inject the gameplay scripts (`mod_engine.js` and `bridge.js`) into the Kirka.io game canvas to render the HUD overlay, enable Three.js material visual modes, and automate movement inputs.
• Security Profile: Strictly scoped. The extension cannot run on or interact with any other website, search engine, social media platform, or banking portal.
--------------------------------------------------------------------------------
5. ARE ALL OF THESE PERMISSIONS STRICTLY NECESSARY?
--------------------------------------------------------------------------------
YES. Every single permission listed in manifest.json is strictly required for the core functionality of the extension, adhering strictly to Google's "Principle of Least Privilege" (PoLP):
1. Can we remove "storage"?
If the "storage" permission were removed, the extension could not persist your slider settings (such as fire rate multiplier, jump interval, or speed boost) between game sessions. Every reload of the game would wipe out your adjustments and revert to initial hardcoded values.
2. Can we remove "https://kirka.io/*"?
No. Chrome Manifest V3 mandates that any extension injecting scripts or HUD elements into a webpage must explicitly declare the specific host URL. Without "https://kirka.io/*", Chrome's security model will prevent the extension from interacting with the Kirka game canvas entirely.
3. Are there ANY unnecessary or dangerous permissions requested?
ABSOLUTELY NOT. Notice the permissions that were DELIBERATELY EXCLUDED:
- NO `<all_urls>` or broad host permissions: The extension is scoped only to kirka.io.
- NO "tabs" permission: Avoided to protect user browsing privacy.
- NO "webRequest" or "declarativeNetRequest": We do not intercept network traffic.
- NO "cookies": We do not read or modify browser cookies.
- NO "management" or "nativeMessaging": No native code execution.
By restricting the extension to the bare minimum set of permissions, the extension guarantees maximum security, protects user privacy, and ensures a seamless review and approval process on the Chrome Web Store.
6. CONTACT & INQUIRIES
If you have any questions regarding this Privacy Policy or the security architecture of the extension, please refer to the documentation included in the extension onboarding guide.