Your data stays with you.

What is covered

• VS Code extensions

  Cipher Workbench, CircuIT Chat, Database Navigator, Leviathan Forensics, Nexus Connect and Permuteatron, and any extension I publish in future under the same publisher name.

• Browser extensions

  GreasyBoii for Chrome and Firefox, which runs the JavaScript and CSS you write on the pages you choose, and any browser extension I publish in future. GreasyBoii has its own section below because its permissions are broad enough to deserve one.

• Desktop applications and firmware

  Link (formerly Nexus Terminal), Fury and Flipper Blue++.

• Browser-based tools on this site

  Leviathan, DAS, CodeNavigator, Unity Save Editor, the Settlers II Savegame Editor, the identity generator, the puzzles and games, and everything else under Side Quests. These run entirely in your browser once the page has loaded.

• Self-hosted servers and libraries

  Basilisk, Panopticon, Squish, NeoCMS, Noema and Webhooks to Email when you run them on your own infrastructure. You are the operator and the only party with access to whatever they hold.

• Services I operate

  Blackwall at blackwall.cx, including its CryptBin encrypted sharing, and Contingency at contingency.cc. These run on my infrastructure and necessarily hold data for you, so they get their own section below with the encryption spelled out.

Data collected: none

Store policies ask developers to declare which categories of user data their software handles. For every project listed above, the answer in each category is the same. The software does not collect, access for any purpose other than the feature you invoked, or transmit any of the following:

• Personally identifiable information

  No name, address, email address, age, identification number or any other identifier.

• Health and financial information

  Nothing of either kind.

• Authentication information

  No passwords, credentials, security questions, personal identification numbers, API keys or tokens leave your device. Where the software stores credentials for you (see below), they stay in your local storage.

• Personal communications

  No emails, messages, chat text or call records.

• Location

  No GPS, IP-derived or any other location data.

• Web history and user activity

  No list of pages visited, no clicks, no keystrokes, no mouse movement, no scroll tracking, no timing, no feature usage statistics.

• Website and file content

  The files you open, the text you select, the binaries you analyse, the spreadsheets you load and the pages you view are processed on your device and go nowhere else.

• Device and diagnostic data

  No device identifiers, crash reports, error logs, performance metrics or telemetry of any kind. There is no analytics library in any of my software, and no "anonymous usage statistics" opt-in or opt-out, because nothing is measured.

Because nothing is collected, nothing is sold, nothing is shared with third parties, nothing is used for advertising, nothing is used to determine creditworthiness or for lending, and nothing is used for any purpose unrelated to the software's single, stated function. I do not operate a server that my software reports to, and I have no accounts system, so I cannot identify an individual user even if asked.

What stays on your device

Some of the software remembers things between sessions so that it is useful. All of it is stored locally, under your control, in the place the platform provides for that purpose: VS Code's own extension storage, your operating system's application data directory, or your browser's local storage for the web tools. Examples:

• Settings and preferences such as theme, layout and the options you last used.

• Connection profiles in Nexus Connect, Database Navigator and Link: the hosts, ports, usernames and, if you choose to save them, the credentials for systems you connect to. Link keeps these in a vault encrypted with a passphrase only you know.

• Your own API keys in CircuIT Chat, entered by you, stored by VS Code's secret storage on your machine and sent only to the AI endpoint you configured.

• GreasyBoii rules, the matching conditions and the JavaScript and CSS you wrote, in your browser's extension storage. See the GreasyBoii section for what "sync" means there.

• Game progress and puzzle state in the browser games, kept in your browser's local storage.

Uninstalling the software, or clearing the relevant storage, removes all of it. None of it is synchronised to me or to anyone else by my code. If your editor, browser or operating system offers its own settings sync, that is a feature of that platform, governed by that platform's privacy policy, and it is your choice whether to enable it.

Network connections the software makes on your instruction

Several of these tools exist to talk to other systems. Every such connection goes directly from your device to the endpoint you chose, using the credentials you supplied. Nothing is proxied, relayed, logged or copied through any server of mine.

• Nexus Connect and Link open SSH, Telnet and raw TCP sessions to the hosts in your profiles, and SFTP to the same hosts.

• Database Navigator connects to the database servers you configure and sends them the queries you write.

• CircuIT Chat sends the messages you type to the AI provider you configured, with your key. What that provider does with them is set out in its own policy.

• CodeNavigator fetches the public repository you name from GitHub's API, from your browser.

• Webhooks to Email, when self-hosted, delivers to the address you configure.

Leviathan, DAS, Fury, Squish, Cipher Workbench, Permuteatron, GreasyBoii (apart from the downloads and rules you run) and the games make no network requests at all once loaded. Installation and updates for extensions are handled by the marketplace you installed from (Microsoft, the Eclipse Foundation, Google or Mozilla) under that marketplace's own policy; my code does not run its own update check.

GreasyBoii

GreasyBoii is a user-script manager: you write a rule (a URL fragment, a CSS selector, or both) and the JavaScript or CSS to apply when it matches, and the extension applies it. It also has tools for auto-clicking elements, finding and replacing text, harvesting links, scraping page data to CSV or JSON and downloading the media on a page. To do that it asks for more than most extensions, so here is exactly what each permission is for and what happens to the data it touches.

• Access to all websites (host permission)

  A small content script loads on each page to check whether any of your rules match its address or contain the element you specified. If none match, it does nothing. It does not read, record, summarise or transmit page content, browsing history or anything else. Your rules run only on the pages they match, and they run as your code, in your browser, on your behalf.

• Storage

  Your rules, the master on/off state and a short-lived scratch value used by the element picker are kept in the browser's extension storage. Rules use the browser's "sync" storage area so that they follow you between your own devices. That synchronisation is performed by Chrome or Firefox under Google's or Mozilla's account and privacy terms, only if you are signed in to the browser with sync enabled, and it is between your devices, not to me. If you are not signed in, the data stays on the one machine.

• Active tab and scripting

  Used to inject your rule's JavaScript and CSS into the tab it matches, to run the element picker when you click "Pick on page", and to apply the one-click dark mode rule. Nothing is injected into a page you have not written a rule for, other than the passive check described above.

• Downloads

  The bulk media downloader, link exporter, scraper and rule export all save files to your device through the browser's normal download mechanism. The media downloader fetches files from the site you are on, with that site's cookies, so that images behind a login can be saved; those requests go to that site, exactly as if you had clicked the file yourself, and nowhere else.

One tool appears only on chatgpt.com: the conversation export reads the messages on screen, turns them into Markdown and fetches the conversation's images from OpenAI with your own session so they can be saved beside it. Those requests go to OpenAI, as they would when the page loaded them, and nowhere else.

GreasyBoii makes no network requests of its own. It has no server, no account, no update check, no analytics and no crash reporting. The only network traffic it ever causes is the traffic your own rules and downloads generate, to the sites you pointed them at. Rule import and export are plain JSON files on your disk, and sharing them is your choice.

Because the extension runs code you wrote, it is your responsibility to know what that code does: a rule that sends page data to a server of your choosing will do exactly that. The extension itself never adds any such behaviour, and the extension's own code is included in full in the package with nothing loaded remotely.

Permissions

Where a store or platform asks an extension to declare permissions, each one is requested for the single feature it enables and for nothing else: file system access to open the file you chose, network access to reach the host you configured, clipboard access to copy the result you asked for, and in GreasyBoii's case access to all sites so that your rules can match any of them. No permission is used to collect, monitor or transmit information about you, and no permission is requested that the software does not need for its advertised purpose.

For any Chrome extension, the use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. In practice no Google API data is received, because none is requested.

No remote code

Every line of code the software runs is included in the package you installed or the page you loaded. Nothing fetches and executes scripts, modules or configuration from a remote server at runtime. Where a project is open source on GitHub, you can check this claim against the code rather than take my word for it.

Services I operate

Three things on my own infrastructure receive data, because that is their job. Each handles only what you send it, for the purpose you sent it. Nothing is sold, shared with anyone, used for advertising, profiled or combined with anything else, and none of them runs analytics or telemetry. Both hosted products are designed so that the most sensitive material is encrypted in a way I cannot undo: the server holds ciphertext and the means to serve it back, not the means to read it.

• The contact form on this site

  Sends your name, email address and message to me by email so that I can reply. It is kept in my mailbox for as long as the conversation is useful and deleted on request.

• Blackwall (blackwall.cx)

  Blackwall is a passkey-only OAuth 2.1 and OpenID Connect server. There are no passwords anywhere in it, so there is no password to store, hash or leak. For each account it holds a display name, an email address, the public halves of the WebAuthn credentials you registered (the private keys never leave your authenticator) and the projects and privilege levels assigned to you. For each application it holds the OAuth client registration, the consents you granted and the tokens issued, which you can inspect and revoke from the portal. Every authentication and authorisation decision is written to an audit log with a timestamp, the account, the client and the requesting IP address, because that log is the product's security guarantee. Sessions and CSRF tokens are signed with secrets that exist only in the server's configuration.

  CryptBin is Blackwall's end-to-end encrypted sharing. When you create an item, your browser generates a random data encryption key, encrypts the text or file with AES-256-GCM, and places the key in the share link after the hash sign. Browsers never send the part of a URL after the hash to the server, so the key does not reach me and the plaintext never does either. What the server stores is the ciphertext, its size and type, creation and expiry times, and a copy of the data key wrapped with XChaCha20-Poly1305 under a server-side key encryption key, with the item's identifier bound in as additional authenticated data so a wrapped key cannot be moved to another item. That wrapped copy is released only after a verified WebAuthn assertion, and an item can additionally be bound to one specific credential. The administrative view shows size, type and dates only; there is no operation that yields plaintext. Updating or deleting an item requires the fragment key. Expired items are removed by a scheduled cleanup, and the ciphertext files are stored with owner-only permissions.

  Anyone who has the complete link has the key. Send it through a channel that matches the sensitivity of the content, and do not paste it into tickets, chat rooms or screenshots.

• Contingency (contingency.cc)

  Contingency is a dead man's switch: you set a schedule, check in, and if you stop checking in the messages, files and actions you configured are released to the people you chose. To do that it holds your account (email address, a password hashed with Argon2id, any authenticator app, passkeys and recovery codes you set up, and your active sessions), the contingencies themselves, the recipients you named and the schedule and grace settings you chose.

  The sensitive parts, meaning message bodies, attached files, SSH private keys for remote actions and webhook signing secrets, are envelope-encrypted with XChaCha20-Poly1305: each secret gets its own random key, and that key is wrapped by a master key that lives in the server's environment and is never written to the database. A copy of the database on its own therefore contains no readable secrets. The cancellation shared secret is hashed with Argon2id, and release-access tokens are hashed where the design allows it, so neither is retained in plaintext. Every state change, from arming to reminder to release, is recorded in a SHA-256 hash-chained audit log in the same transaction that performs it, which makes silent tampering detectable. Outbound webhooks are HMAC-signed. There is no administrative role inside the web application; operator tasks happen on the host, deliberately outside the web interface.

  When a contingency is released, its content is delivered to the recipients you configured, and from that moment it is in their hands. You can delete a contingency in any state, subject to fresh re-authentication so that a stolen session cannot dismantle an armed plan. Deletion cryptographically erases the attachments first (ciphertext removed, wrapped key nulled) and then retires the record, leaving only an audit event recording that it was deleted and the state it was in. Deleting your account removes it under the same protections. The service's own documentation describes the lifecycle, the API and the threat model in full.

Both hosted services are served through Cloudflare and keep standard request logs on the same basis as this website, described below.

This website

dixon.cx runs no analytics, no advertising and no third-party tracking scripts. It sets no cookies. Your choice of light or dark theme is kept in your browser's local storage and never sent anywhere. The site is served through Cloudflare, and both Cloudflare and my origin server record standard request logs (IP address, requested URL, user agent, time) for security and fault-finding; those logs are not used to identify or profile visitors and are rotated rather than kept. Cloudflare's handling of that traffic is described in Cloudflare's own privacy policy.

Pages that embed third-party fonts or verification badges (Google Fonts on a few tools, Credly on the qualifications page) cause your browser to request those resources from the third party, which will see your IP address in the ordinary way. No other third-party requests are made.

Children

None of the software is directed at children under 13, and because it collects nothing, it collects nothing from children either. If you believe a child has sent me personal information through the contact form, email me and it will be deleted.

Your rights

Under the UK GDPR and the Data Protection Act 2018, and equivalent laws elsewhere including the GDPR and the CCPA, you have the right to know what personal data an organisation holds about you, to have it corrected or deleted, to restrict or object to its processing, and to receive a copy. For the software covered by this policy, I hold nothing, so there is nothing to access, correct, delete or export: the data is on your device and you can inspect or remove it yourself at any time.

The only personal data I may hold is an email conversation you started through the contact form. Email me to have it deleted. If you are unhappy with how I have handled a request, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

The strongest protection for your data is not moving it, which is the design principle behind everything here. Where the software stores credentials locally it uses the platform's secret storage or, in Link, a vault encrypted with a key derived from your passphrase. Fury encrypts with post-quantum key agreement. Where a project is open source, the implementation is public and can be audited.

Changes to this policy

If any of this changes, for example if a future project genuinely needs to send something somewhere, this page will be updated, the effective date at the top will change, and the change will be described in that project's release notes and store listing before the version that makes it ships. The current version is always at dixon.cx/privacy.

Contact

Andy Dixon, United Kingdom. Questions about this policy, or about any of the software it covers: [email protected], or use the contact form.