PRIVACY POLICY - STEAM WORKSHOP DOWNLOADER
Last Updated: October 2026
1. INTRODUCTION & CORE PRINCIPLES
"Steam Workshop Downloader (Skymods/Modsbase)" is committed to respecting and protecting your privacy. This extension was built with a privacy-by-design philosophy: we collect zero personal information, run zero tracking scripts, and operate entirely locally in your browser.
We believe users should always know exactly how software works and why permissions exist. This document explains what the extension does, the data it handles, and why each permission is strictly necessary.
==================================================
2. DATA COLLECTION & TELEMETRY: ZERO
==================================================
- No Personal Data Collected: The extension does not collect your name, email, IP address, browsing history, Steam credentials, or Steam ID.
- No External Analytics / Tracking: We do not use Google Analytics, Mixpanel, Sentry, or any third-party tracking or advertising SDKs.
- No Remote Servers: We do not operate any proprietary backend server that monitors your activity.
- Local Storage Only: All preferences (such as your chosen download subfolder or UI toggles) and usage counters (number of mods scanned/downloaded) are stored solely on your local device using Chrome's local storage API (`chrome.storage.local`). This data never leaves your browser.
==================================================
3. EXPLANATION OF PERMISSIONS & WHY THEY ARE NEEDED
==================================================
1. "downloads" Permission
- What it does: Grants the extension the ability to initiate file downloads via Chrome's native download manager.
- Why it is needed: When you click the green "Download" button on a Steam Workshop page, the extension resolves the direct archive link from Modsbase and triggers a `.zip` file download directly to your computer's designated downloads folder.
- Can it be removed? No. Without this permission, the extension would not be able to download mod files automatically.
2. "storage" Permission
- What it does: Allows the extension to read and write key-value settings in Chrome's offline local storage.
- Why it is needed: Used exclusively to remember your preferences (e.g., your custom folder name `SteamWorkshop/` and whether auto-scan is enabled on browse pages) and to keep a local tally of downloaded mods.
- Can it be removed? No. Without local storage, your custom settings would reset every time you close the popup or restart Chrome.
3. Host Permission: "https://steamcommunity.com/*"
- What it does: Permits the extension's content script to run on Steam Workshop pages.
- Why it is needed: The extension needs to read the Workshop item ID and game App ID from the page, and inject the "Download" / "Not Available (Request)" buttons directly beside Steam's native "Subscribe" button.
- Can it be removed? No. Without access to Steam Community Workshop pages, the extension cannot display download buttons or floating collection widgets.
4. Host Permission: "http://*.smods.ru/*" and "https://*.smods.ru/*"
- What it does: Allows the extension's background service worker to send HTTP requests to the Skymods catalogue.
- Why it is needed: When you view a Steam Workshop item, the extension queries the Skymods database to check whether the mod has an available mirror, extract its latest update timestamp, and retrieve the download reference link.
- Can it be removed? No. This is essential to determine whether a mod is ready to download or if a request link should be shown.
5. Host Permission: "https://modsbase.com/*"
- What it does: Allows the extension to send an automated POST request to the Modsbase hosting server.
- Why it is needed: Skymods hosts its mod files on Modsbase. When you initiate a download, the extension resolves the intermediate download token on Modsbase to retrieve the direct `.zip` archive download URL.
- Can it be removed? No. Without this permission, the extension could not obtain direct download links from the file host.
==================================================
4. ARE ALL THESE PERMISSIONS REALLY NECESSARY?
==================================================
YES, absolutely—and NOT A SINGLE UNNECESSARY PERMISSION IS REQUESTED.
Here is why our permission footprint is minimal and strictly adheres to Google's Principle of Least Privilege:
- We DO NOT request `<all_urls>` or `*://*/*`: Many extensions request access to all websites on the internet. We strictly limit host access to the exact three domains essential to our core purpose (`steamcommunity.com`, `smods.ru`, and `modsbase.com`).
- We DO NOT request "cookies" permission: We do not inspect or manipulate your browser cookies.
- We DO NOT request "webRequest" or "declarativeNetRequest": We do not monitor, inspect, or tamper with your network traffic.
- We DO NOT request "identity": We never access your Google or Steam identity or user account.
- We DO NOT request "tabs": We do not read other tabs or monitor your open websites.
Every single permission requested is an essential building block directly tied to the single purpose: verifying and downloading Steam Workshop mods.
==================================================
5. THIRD-PARTY INTERACTIONS
==================================================
When you interact with the extension:
1. Steam Community: Injected scripts read public Workshop page markup (mod ID, game title, subscribe button).
2. Skymods (smods.ru): An API query is made solely with the Workshop item ID and game App ID to verify availability.
3. Modsbase (modsbase.com): A standard POST request is submitted with the mod download ID to fetch the file link.
4. Google Forms: If you click "Not Available (Request)", you are redirected to the public Google Form maintained by the Skymods team to request missing mods.
No tracking IDs or personal identifiers are transmitted in any of these interactions.
==================================================
6. SECURITY & MANIFEST V3 COMPLIANCE
==================================================
This extension is built entirely on Google's modern Manifest V3 architecture:
- No remote code execution: All scripts are bundled locally inside the extension package.
- Content Security Policy (CSP): Enforced to prevent any third-party script injection or external execution.
- Secure communication: Background service worker coordinates network requests safely without exposing your browsing environment.
==================================================
7. CHANGES TO THIS POLICY
==================================================
Should any updates be made to this privacy policy in future versions, they will be documented in the extension's release notes and on our official documentation page.
==================================================
8. CONTACT & FEEDBACK
==================================================
For questions, support, or privacy inquiries regarding this extension, please open an issue or reach out via our official documentation page at `strona/index.html`.