PRIVACY POLICY & PERMISSION AUDIT FOR SUBNOVA
Last Updated: October 30, 2026
SubNova ("we", "our", or "the extension") is built with strict privacy-by-design standards. This document details our privacy practices, audits every browser permission, and explains why each permission is used.
================================================================================
1. PERMISSION AUDIT & MINIMAL PRIVACY FOOTPRINT
================================================================================
Are all requested permissions strictly necessary? YES.
Following our security audit, we removed redundant "host_permissions" so that the extension requests only the absolute minimum required permissions:
A. "storage"
• Purpose: Saves the user's styling customizations (font size, font color, background contrast, vertical offset, and shortcut toggles) locally in chrome.storage.local.
• Why it is strictly necessary: Without this permission, the user's subtitle styling would reset to defaults every time the popup or tab closes.
• Data accessed: Only local preference key-value pairs. No personal data.
B. "activeTab"
• Purpose: Enables secure communication between the popup UI and the currently focused video tab when the user clicks the extension icon.
• Why it is strictly necessary: Allows the popup to query the active video player and send subtitle cues exclusively to the active tab, without reading or touching any background tabs.
C. Content Scripts ("matches": ["<all_urls>"])
• Purpose: Detects the HTML5 <video> element on video platforms, listens for dragged .srt or .vtt subtitle files, and renders the subtitle overlay above the video.
• Why it is strictly necessary: Video streaming happens across thousands of domains (YouTube, Vimeo, Dailymotion, educational platforms, cloud drives, independent streaming hubs). The content script must be able to hook into <video> tags on any site where the user chooses to watch.
• Security & Privacy: Runs purely client-side in the page DOM. It does not monitor browsing history, does not touch cookies, does not read form inputs, and does not transmit any URLs.
================================================================================
2. 100% LOCAL PROCESSING & ZERO DATA COLLECTION
================================================================================
• No Server Communication: Subtitle files loaded via drag-and-drop or file picker are parsed directly in local browser memory using JavaScript. They are never sent to any server.
• Zero Telemetry: SubNova contains no analytics SDKs, no trackers, no external beacon requests, and no advertisements.
• No Registration: No account or sign-up is required.
• External Links: External search shortcuts (e.g. OpenSubtitles) simply open search queries in a new browser tab. No personal data or user tokens are shared.
================================================================================
3. WELCOME PAGE & ONBOARDING (newhello.html)
================================================================================
Upon initial installation, SubNova opens a welcome tab (newhello.html). This page embeds the official documentation via an iframe without any artificial loading screens or tracking scripts.