# Privacy Policy — ON-AIR Meeting Trigger

**Last updated:** 2026-10-17

## Overview
ON-AIR Meeting Trigger is a privacy-first browser extension designed to detect when the user is in an online meeting and signal that state to user-configured endpoints. The extension operates entirely on the user’s device.

This policy covers every build of the extension: the [Chrome Web Store](https://chromewebstore.google.com/detail/dhcgpjlbnchcbnpplfidkfbfmapokhfn?utm_source=item-share-cb) version (Chrome, Chromium, Edge and other Chromium-based browsers), the [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/on-air-meeting-trigger/) version, and builds made from the source code. They share the same code and behave the same way.

## Data collection
This extension does **not** collect, store, sell, or transmit user data to the developer or any third party.

Specifically:
- No analytics are used
- No telemetry is sent
- No personal data is collected
- No browsing history is logged
- No data is transmitted to external servers operated by the developer

## Network requests
The extension may send HTTP requests **only to network endpoints explicitly configured by the user**, such as:
- Home Assistant
- Local IoT devices (e.g. Tasmota, Shelly, ESP-based devices)
- Notification services the user chooses (e.g. ntfy, Pushover, Telegram), using the user's own topic, account or bot
- User-owned local webhooks or scripts
- **User-owned cloud endpoints** the user has deployed in their own AWS account (e.g. an API Gateway + Lambda that publishes to AWS IoT MQTT, as scaffolded by the companion firmware repo's `scripts/cloud-bridge/` deployment helper). The developer of this extension has **no access** to this infrastructure — the user owns the AWS account, the Lambda code, the bearer token, and the cost of every invocation.

These requests are initiated solely for the purpose of signaling meeting state (ON/OFF).

The extension:
- Does **not** scan the local network
- Does **not** communicate with unknown or automatic endpoints
- Requests host permissions only after explicit user approval

## Meeting detection
To perform its single purpose, the extension checks whether browser tabs matching supported meeting services (Google Meet, Microsoft Teams, Zoom, or sites the user adds) are open or active.

- Only tab URLs and active status are evaluated
- Page content is not read
- Meeting state is kept only as runtime state, except for the optional diagnostics log described below

## Diagnostics log (optional, off by default)
If the user turns on **Enable debug logging**, the extension keeps a rolling log of up to 200 recent events (state changes, the meeting service, per-endpoint results and errors) in the browser's local extension storage. It never leaves the device unless the user copies it (e.g. **Copy report**, which redacts credentials). Turning logging off stops recording.

## Optional data in requests
The extension may include in the requests it sends to user-configured endpoints:
- Meeting state (`ON` / `OFF`)
- Meeting service identifier (e.g. `meet`, `teams`, `zoom`)
- Meeting URL — by default only the **site origin** (e.g. `https://meet.google.com`),
  which carries no meeting ID. The full URL (including the meeting ID) is sent
  **only** if the user explicitly enables "Include the full meeting URL" in Settings.

This data is sent **only** to endpoints configured by the user and is not retained or transmitted elsewhere.

## Authentication
If an endpoint requires authentication (for example, the Home Assistant REST API or an AWS IoT cloud bridge), credentials or tokens are provided directly by the user.

- Credentials are stored in the browser's **local** extension storage (`storage.local`) and are **not** synced to the user's browser account (Google or Firefox account).
- Credentials are **excluded from exported settings files** by default; the user must explicitly opt in to include them.
- The extension does not intercept, transmit, or reuse authentication data for any purpose other than calling the endpoints the user configured.

## Third-party access
The developer does not have access to any data generated or transmitted by the extension.

No data is shared with advertisers, analytics providers, or external services.

## Changes
If this privacy policy changes in the future, it will be updated in the project repository and reflected in the Chrome Web Store and Firefox Add-ons listings.

## Contact
Please use the project issue tracker for privacy questions:
https://github.com/mveplus/onair-meeting-trigger/issues