================================================================================
PRIVACY POLICY & PERMISSION AUDIT
Prodigy Math Hacker & Mod Loader (Prodigy X)
Last Updated: October 2026
================================================================================
1. INTRODUCTION & CORE PRIVACY COMMITMENT
This Privacy Policy outlines how Prodigy Math Hacker ("we", "our", or "the extension") handles user information and explains the technical necessity of each browser permission requested.
We believe in radical data privacy. Prodigy Math Hacker is designed as a 100% client-side enhancement utility. We DO NOT collect, sell, monetize, transmit, or monitor any personal data, account credentials, browsing history, or keystrokes.
--------------------------------------------------------------------------------
2. WHAT DATA IS STORED & WHERE
--------------------------------------------------------------------------------
The extension only handles non-personal, user-configured technical preferences:
- Master On/Off Toggle status (true/false)
- Selected Script Preset ("prodigyx", "origin", or "custom")
- User-specified Script URLs (e.g., custom GitHub raw links)
Storage Location:
All data is stored exclusively on your local device via Chrome's native storage engine (`chrome.storage.sync` / `chrome.storage.local`). If you have Chrome Sync enabled, this non-personal configuration is synchronized across your own devices through your personal Google account. No data is ever routed through external third-party servers owned by the extension authors.
--------------------------------------------------------------------------------
3. EXPLANATION OF BROWSER PERMISSIONS
--------------------------------------------------------------------------------
Why does Prodigy Math Hacker request specific permissions? Here is a clear, transparent explanation:
A. "storage"
- Purpose: Stores your preferred settings and custom script URLs locally.
- Why it is needed: Without this permission, any custom URLs or toggle states would reset to defaults every time you close the extension popup or restart the browser.
B. "declarativeNetRequest"
- Purpose: Modifies specific network requests at the browser engine level.
- Why it is needed: In order for the custom mod menu to function inside the Prodigy Math game, the extension must:
1. Intercept and block the unpatched base game script (`https://code.prodigygame.com/code/*/game.min.js?v=*`).
2. Strip restrictive HTTP headers (`Content-Security-Policy` and `X-Frame-Options`) on `math.prodigygame.com` so the browser allows the modified client-side script bundle to execute.
This API operates declaratively without inspecting or logging your web traffic content.
C. Host Permission: "*://*.prodigygame.com/*"
- Purpose: Grants the extension authority to interact with Prodigy Math web pages.
- Why it is needed: Used by the content script (`contentScript.js`) to inject the mod menu overlay into the game interface and verify the active game session.
D. Host Permission: "*://raw.githubusercontent.com/*"
- Purpose: Grants the extension authority to fetch script bundles from GitHub's raw CDN.
- Why it is needed: When you launch the game with Prodigy X or Play Origin presets, the extension downloads the latest verified open-source script bundle directly from GitHub to ensure you have the newest bug fixes and anti-cheat patches.
--------------------------------------------------------------------------------
4. PERMISSION AUDIT: ARE ALL THESE PERMISSIONS STRICTLY NEEDED?
--------------------------------------------------------------------------------
A common question for developers and users submitting to the Chrome Web Store is: "Are all these permissions definitely necessary, or can we reduce the permission footprint?"
Here is our direct technical assessment:
1. `storage`:
STATUS: ESSENTIAL (REQUIRED)
Without `storage`, user preferences, custom script URLs, and the master enable/disable switch cannot persist.
2. `declarativeNetRequest`:
STATUS: ESSENTIAL (REQUIRED)
Prodigy Math enforces subresource integrity and strict CSP. Without DeclarativeNetRequest to block the default game script and relax header restrictions, client mods cannot inject or load into the game engine.
3. `declarativeNetRequestFeedback`:
STATUS: NOT NECESSARY FOR PRODUCTION (RECOMMENDED TO OMIT)
In earlier Manifest V3 development versions, `declarativeNetRequestFeedback` was included. However, this permission is only required if your extension calls `chrome.declarativeNetRequest.getMatchedRules()` to inspect which rules matched.
For end-users in production, static rules defined in `rules.json` work seamlessly WITHOUT `declarativeNetRequestFeedback`.
*DECISION*: In our current production `manifest.json`, we have REMOVED `declarativeNetRequestFeedback`. This eliminates unnecessary permission warnings during extension installation and substantially speeds up Chrome Web Store review approval!
4. Host Permissions (`*://*.prodigygame.com/*` & `*://raw.githubusercontent.com/*`):
STATUS: ESSENTIAL (REQUIRED)
These are strictly scoped to the game domain and the GitHub script host. Narrowing permissions to only these two specific domains adheres strictly to Google's Principle of Least Privilege.
--------------------------------------------------------------------------------
5. CHILDREN'S PRIVACY & EDUCATIONAL CONTEXT
--------------------------------------------------------------------------------
Prodigy Math is widely enjoyed by elementary and middle school students. We adhere to the highest privacy standards regarding minors:
- We do not knowingly collect any personally identifiable information from children under 13 (or under 16 in the EEA/UK).
- The extension does not collect usernames, student IDs, parent emails, or classroom codes.
- No ads, tracking pixels, or third-party behavioral profiling scripts are included.
--------------------------------------------------------------------------------
6. DATA RETENTION & USER CONTROL
--------------------------------------------------------------------------------
- You have complete control over your data.
- To erase all stored configuration, click "Reset Defaults" in the extension popup or uninstall the extension from `chrome://extensions`.
- Uninstalling the extension immediately purges all locally stored preferences.
--------------------------------------------------------------------------------
7. CONTACT & INQUIRIES
--------------------------------------------------------------------------------
If you have questions, feedback, or concerns regarding this Privacy Policy or permission usage, please visit the documentation page included with the extension (`strona/index.html`) or submit an inquiry through the project repository.