Why we build privacy-first browser extensions

A browser extension sees a lot: the pages you visit, the forms you fill, sometimes everything you type. That access is exactly why most extensions are worth being careful about — and why ours are designed to need as little of it as possible.

The least-privilege rule

Every feature in QRForge and ShieldMail is built to work without a server round-trip. QR codes are rendered locally. Temporary addresses are generated in your browser. If a feature doesn't need network access, it doesn't get it.

• No accounts, no profiles, no analytics
• Local-first: generation and storage happen on your device
• Permissions are scoped to what each feature actually does
• The code is open source, so the claims are verifiable

What we ask for, and why

Browser stores make extensions declare every permission up front. Ours are deliberately short:

• No "read your browsing history" — QRForge only works with what you explicitly paste or select
• No "access all websites" — neither extension injects scripts into pages you visit
• No network permissions for QRForge — generation is pure local math
• Storage, scoped to the extension — history and settings live in the extension's own sandbox

If a permission isn't required by a feature you can point to, it doesn't belong in the manifest.

How to evaluate any extension

You can apply the same lens to any tool before you install it:

1. Read the permission list in the store listing — every entry should map to a feature you can name
2. Check whether the extension works offline; if it does, the "cloud" features are optional, not required
3. Look for a privacy policy that says what's not collected, not just what is
4. Prefer open source when you can — you don't have to read the code, but the option matters

The best privacy policy is the one you don't need, because there is nothing to collect.

Privacy as a feature, not a footnote

We treat "your data stays on your device" as a headline feature, not a legal footnote. It's the reason QRForge works offline, and the reason ShieldMail can auto-delete messages on a schedule without ever sending them anywhere.

Building this way costs a little more engineering time — but it means the product can never betray its users, even if we wanted it to.

What's coming

We're working on signed, reproducible builds so you can verify that the code in the store matches the code on GitHub, and on a permission-by-permission explainer inside the extensions themselves. If there's a privacy guarantee you'd like to see made explicit, tell us — we'd rather over-communicate than under-deliver.