Status: 2026-10-08. The English twin of PRIVACY.md, line for line: a change to permissions, network requests or what is saved updates both, in the same commit. It is the privacy policy behind the store listings (pnpm packs:export turns it into privacy-en.html).
Everything Puffkin has stays in your browser. No account, no analytics, no ads, and your browsing history is never read. Only three kinds of request leave it: site icons (on by default, can be turned off, explained the first time you open it), companion art that is fetched only when you press "Download" for one, and a weather lookup that happens only if you turn on "Real" weather.
| Permission | Why | When it is asked for |
|---|---|---|
storage | Keeps your settings and progress | At install |
favicon | Reads site icons the browser already has cached, for the Dock | At install |
search | Searches with your browser's default search engine | At install |
activeTab | When you press the toolbar button, the shortcut (Alt+Shift+S) or choose "Give this page to Puffkin to keep" from the right-click menu, it reads that page's address and title and hands them to "To sort" on the new tab. When you choose a result from pf in the address bar and press Enter, it looks at whether the current tab is an empty new tab (if so the site opens there, otherwise in a new tab), without keeping anything. Only at that moment, only for that page; it never reads page content and never reads any page in the background | At install; no warning when installing |
contextMenus | The right-click entries "Give to Puffkin to keep" (links) and "Give this page to Puffkin to keep", and on the toolbar icon "Open a Puffkin new tab" and "Search Puffkin…" | At install; no warning |
scripting | When you press Alt+Shift+F (or "Search Puffkin…" on the toolbar icon), it puts a search box on that page. With activeTab, only at that moment and only for that page; what it puts there is a frame showing the extension's own page, it does not read the page's content, and the page cannot see what you type into the box; closing it removes it entirely | At install; no warning when installing |
bookmarks (optional) | Two things, both only after you turn them on in settings: ① with "Search bookmarks too" on, as you type in a search box (the new tab and the Alt+Shift+F overlay) the browser's own bookmark search lists matching pages below, nothing is copied, kept or uploaded, and their icons come only from the browser's cache (never from Google's icon service); ② "Import from bookmarks…" reads your bookmark folders once and the ones you tick become cards on the desktop (only what you choose is kept, like cards you add by hand) | Asked at the moment you choose it; when "Search bookmarks too" is off, or an import is over and search is not on, the permission is handed back to the browser |
topSites (optional) | Puts your browser's "most visited" sites on the Dock | Asked only when you press OK; you can say no and add sites by hand later |
Not needed and never requested: history (browsing history), tabs, "read and change all your data on all websites". bookmarks is an optional permission only, as above.
Files open to web pages (web_accessible_resources): only the search box page find.html, with use_dynamic_url. A web page cannot reach it at a fixed address (it is turned away like any file that is not open), so it cannot use it to tell whether you have Puffkin installed.
The background script (background.js) does three things, none of which makes a network request:
puffkin.queue in chrome.storage.local, at most 200), deleted once the new tab has taken them.find.html over the current page, and the site you choose opens in a new tab (⇧Enter: the current one). On pages the browser keeps extensions away from (pages starting with chrome:// or edge://, the extension stores) it cannot, so it opens a new tab whose search box is ready to type in. Icons in the search box come only from the browser's own cache, never from Google's icon service (it sits on other sites, and every site would ask again).pf (the manifest's omnibox, no permission needed): type pf and a space in the address bar, then a few letters, and it finds sites on your Dock and cards in the copy the new tab leaves for it, listing them below the address bar. The matching happens on your computer only; what you type after pf is neither kept nor sent (only if nothing matches and you press Enter does it go to your browser's default search engine, just as if you had searched from the address bar).Everything is kept in this browser's local storage (localStorage) on this computer and is never uploaded.
| Key | What |
|---|---|
puffkin.companion.v*, puffkin.companion.backups.v* | Names (one for each companion), number and length of hugs, the record of time together (and the last few local backups of it) |
puffkin.dock, puffkin.dock.asked | Sites on the Dock (address, name); whether it has asked about "most visited" sites |
puffkin.metrics | Only in trial builds (the store build counts nothing and has no such item). Trial numbers: per day, how many tabs were opened, touched and hugged, how often it was squeezed to let off steam, minutes of nothing, reminders to drink or stand, and the number of Dock clicks and searches (no addresses, no search text); kept 30 days; it leaves this computer only if you copy it yourself |
puffkin.appearance, puffkin.power, puffkin.parallax, puffkin.hand, puffkin.sound, puffkin.music, puffkin.music.vol, puffkin.icons.remote, puffkin.recSec, puffkin.minutes | Preferences |
puffkin.packs and the browser cache puffkin-packs-v1 | The companions you downloaded (id and version) and their files; "Delete the downloaded…" in settings clears them; they keep working offline from this |
puffkin.sleep, puffkin.weather, puffkin.roam | Bedtime sound and length, weather setting, whether it wanders about |
puffkin.captions | Which of the photo captions were used last (the last 8, so they do not repeat) |
IndexedDB puffkin-album | Photos you took (JPEG) with their caption and date; at most 200; only on this computer, and deleting one in the album really deletes it |
puffkin.arrivals, puffkin.arrival | The last 4 things it was doing when you opened a tab and whether one was opened today (so each time is different); the setting for this |
puffkin.care.on, puffkin.care | Only if you turn on "A light touch of care" in settings: the setting itself; when this stretch of sitting started, when a new tab was last opened, when it last suggested standing up or drinking, how many times today (only times and counts; it cannot see what you do elsewhere). Deleted when turned off |
puffkin.touchmap | Where you touch it most: how often its head, face and belly were touched (three numbers, halved when they grow large); used to turn that side towards your hand |
puffkin.secrets | Which little secrets were found (only to count how many are left) |
puffkin.iconmiss | Sites that have no icon (not asked again for a week) |
puffkin.today | What you wrote for today (the most important thing and small ones); finished ones are cleared the next day |
puffkin.timer | The focus timer's state |
puffkin.note | Your note |
puffkin.collections | Your cards of links (names and addresses; pages kept from the toolbar also have their title) |
puffkin.onboarded | Whether the first question was answered (which interests you picked is not kept, only the Dock and cards it set up) |
puffkin.weather.city, puffkin.weather.cache | Only if you turn on "Real" weather: the city you chose (name and rough coordinates); the last weather it found (rain, snow, wind, temperature) |
puffkin.opens | Sites you opened from this page (Dock, cards, search), from pf in the address bar and from the search box: the site's id, how many times, when last; at most 200, the oldest dropped. Used only to order "Recently used" and search results; not browsing history, pages opened anywhere else are not recorded |
puffkin.inbox.declined | Which groups you said "No thanks" to in the suggestion on "To sort" ("design" or a card's id) and how many there were, so it asks again only after two more of the kind; at most 30, removed once that group has left "To sort" |
puffkin.collections.hints | After you move a site to a card by hand, "this domain → this card", so the same site goes there next time; at most 200, only domains and card ids |
puffkin.queue in chrome.storage.local | Addresses and titles from the toolbar button, the shortcut or the right-click menu that the new tab has not taken yet; deleted once taken |
puffkin.index, puffkin.index.opens in chrome.storage.local | A copy for pf and the search box: the names, addresses, page titles, cards and pinyin of the sites on your Dock and cards, and what is in puffkin.opens. Written by the new tab only when it changed; the background only reads it. A removed site leaves the copy with the next new tab; nothing in the bin is copied |
puffkin.opened in chrome.storage.local | Sites opened from pf or the search box that the new tab has not added to "Recently used" yet: the site's id and the time, at most 200; deleted once taken |
puffkin.find.ask in chrome.storage.session | When the shortcut is pressed on a page where the search box cannot go, a time left for the new tab so it focuses its search; deleted when the new tab sees it, void after 5 seconds. Session storage lives in memory only and is gone when the browser closes |
puffkin.index.sig | A fingerprint of that copy (two short strings), to tell whether it needs writing again |
puffkin.trash | The bin: sites and cards you removed from the Dock or cards (names, addresses), cleared after 30 days, at most 40; you can empty it any time. Only on this computer |
puffkin.bookmarks.search | Only if you turn on "Search bookmarks too" in settings: the switch itself (the bookmarks are not saved) |
puffkin.sync.on, puffkin.sync.device, puffkin.sync.seen | Only if you turn on "Sync the Dock and cards to your other computers": the setting, a random id for this computer (to tell which computer a change came from), a fingerprint of what was last synced |
pf.meta, pf.s.* in chrome.storage.sync | As above, only with sync on: the Dock and cards (names, addresses) in a few pieces, with a note (how many pieces, when, which computer, fingerprint, size). The browser's own sync (Chrome or Edge) carries them to your other computers signed in to the same account; turning sync off leaves them there for the other computers |
puffkin.widgets | Which widgets show on the desktop |
puffkin.lang | Only if you chose a language in settings: zh or en. Otherwise it follows the browser's language and nothing is kept |
puffkin.sync.code | Web page only: the sync code (see below) |
During "Bedtime" the page asks the screen to stay on (Screen Wake Lock) and lets go when it ends or you wake it; no extra permission is needed.
Clearing browser data or removing the extension deletes all of this. "Save a backup" in settings writes the above (without trial numbers, caches or photos) to a JSON file wherever you choose; "Restore from a backup" reads only the file you choose.
Your to-dos, note and sorted links are your own: they stay on this computer, are not uploaded, and are not part of the web page's sync either (that sync holds only the plush's name and your time together).
| Request | To | What | Can it be turned off? |
|---|---|---|---|
| Downloading a companion | Our own asset address (remote in catalog.json, which ships with the extension; downloads can only go there) | Only when you press "Download" for a companion in settings: it fetches that companion's few files (images and JSON, no code; they are hosted on Cloudflare, whose servers can also see the request); the request carries nothing of yours, and every file is checked against the catalogue's fingerprint. The server sees your IP address and the file names, as with any request | Nothing is sent unless you press it. The cloud is inside the package and never needs the network |
| Site icons | t2.gstatic.com/faviconV2 (the static address of Google's icon service; if it is unavailable, www.google.com/s2/favicons) | The domain of each site on the Dock and your cards (no path, no query); the browser caches the image for a week, after which new tabs do not go online for it; a site with no icon is not asked about again for a week | Yes: Settings → "Sharper site icons". Off, only the browser's own icons are used, or the site's initial |
| Browser sync (not a request we make) | The account you signed in to in the browser (Chrome: Google account; Edge: Microsoft account), handled by the browser's own sync service | Only after you turn on "Sync the Dock and cards to your other computers": the names and addresses of the sites on the Dock and cards. The browser carries and keeps them according to your account's sync settings (Chrome can encrypt them with a sync passphrase), never through any server of ours | Off by default; turn it off in settings any time |
| City search | geocoding-api.open-meteo.com (Open-Meteo, a free weather service, no account) | The city name you typed; sent only when you press "Search", not while you type | Not sent by default; only if you choose "Real" weather in settings and press Search |
| Current weather | api.open-meteo.com | The chosen city's rough coordinates (two decimal places, about 1 km); at most every 45 minutes, cached on this computer | Not sent by default. Choose another weather option, or "Forget this city", and it stops |
About IP addresses: your location is never read or used (there is no geolocation permission), and your IP address is not read either; but any network request shows the server the IP address it came from, which cannot be helped. The extension itself neither reads, keeps nor passes it on.
Pages you open yourself are not the extension's requests: when you choose "Search the web" or a site search such as "Search GitHub for…" in the search box, what you typed goes to that site as part of its address (as if you had typed it into its own search box); nothing is sent unless you choose it.
Beyond these, the extension sends no requests at all: the plush's pictures, faces, sounds and interface are all inside the package, and the background music is made live on your computer.
Optional "Sync across devices": when on, the state is encrypted on your device with AES-GCM under a key derived from the sync code, and only the ciphertext and an authentication digest are uploaded; the server has no key to decrypt it, and a lost sync code cannot be recovered. The extension does not have this.
Recordings, photos and stickers are made on your computer. A file leaves the browser only when you press "Download" or "Share", and you choose who it goes to.
Contact: [email protected]