# Privacy and data handling

Better Peakbagger has:

- no Better Peakbagger account;
- no analytics, telemetry, or advertising; and
- no developer-operated data server.

The extension uses data only for the features described here. It does not sell
data or use or transfer it for unrelated purposes or credit decisions.

Data leaves the browser only when a feature requires it:

- **Peakbagger** receives summit lookups and user-approved GPS Preview data.
- **Open-Meteo** receives summit coordinates, elevation when available, and an
  ascent-day window or sixteen past days plus up to sixteen forecast days
  automatically when an enabled weather card approaches the viewport.
- **USDA NRCS** receives public station IDs and relative date ranges when an
  enabled nearby-snow card approaches the viewport. Station matching is local;
  no summit coordinates or GPX are sent to NRCS.
- **NOAA NOHRSC** receives viewed-area tile bounds for an enabled Snow depth
  overlay, plus credential-free reads of its public analysis time and legend.
  An explicit map right-click also sends that point when Snow depth is visible.
- **USGS** receives viewed-area tile bounds when slope or public-land overlays
  are enabled, without GPX, account credentials or referrers. An explicit map
  right-click sends the selected point for applicable visible slope/land readings.
- **3D map providers** receive tile requests for the viewed area only after the
  user enables 3D.
- **Microsoft Planetary Computer** receives viewed-area bounds, a capture search
  date range, and satellite tile requests when Sentinel-2 is selected in 2D or 3D.
- **GitHub** receives only the data types the user explicitly or automatically
  backs up or opts to synchronize to their selected repository.
- **ImgBB** receives a flattened image only when the user uploads it. Copy image
  and Export image in Photo Topos send nothing to a network service.
- **AllTrails, CalTopo, Gaia GPS, and onX Backcountry** receive the saved
  Peakbagger GPX for preview or parsing only when the user clicks the matching
  **Send** button. Final Upload, Import, and Save actions remain manual.
- **Media hosts** receive ordinary browser requests when remote report media is
  displayed.
- **Custom overlay providers** receive direct metadata, tile or GeoJSON requests
  only after the user enables a source or explicitly checks its metadata. Tile coordinates reveal
  the viewed area. Requests omit cookies and referrers and use ordinary
  browser CORS for public sources. Private request parameters use BPB’s
  constrained background relay after optional provider access and bounded map
  approval. Public URL keys remain visible to the page; private values do not.

The Sun and Moon calculator is not a data-transfer feature. Its coordinate,
date, time, map bearing, and astronomical results remain in the Peakbagger tab.

## Browser permissions

| Permission | Purpose and limits |
| --- | --- |
| `storage` | Stores preferences, credentials, caches, drafts, and other extension data as detailed below. |
| `activeTab` | Temporarily accesses only the Garmin Connect or Strava activity tab where the user clicks the toolbar button. This toolbar path has no persistent provider website access; the separate Garmin API connection is optional. |
| `scripting` | Injects packaged adapters into the clicked provider tab to verify ownership and request its same-origin GPX export, into a Peakbagger tab for login and summit requests, and into Gaia, onX, AllTrails, or CalTopo after the matching **Send** click. Optional Instagram access additionally registers the confined display helper described below. It never downloads or executes remote code. |
| `tabGroups` | Groups newly opened ascent drafts under **Peak Drafts** without inspecting or reorganizing unrelated groups. |
| `alarms` | Removes expired session records every five minutes and schedules automatic backups and the 30-second trailing / 15-minute periodic ignored-list sync checks when enabled. |
| Peakbagger host access | Supports GPX analysis, offline Sun and Moon planning, filters, theme, login and summit checks, draft filling, and climber-list management on Peakbagger. |
| Optional GitHub host access | Access to `github.com` and `api.github.com` is requested only when the user connects GitHub. It supports device-flow sign-in and the one repository the user grants. |
| Optional ImgBB host access | Access to `api.imgbb.com` is requested only from the photo editor when the user uploads or from Settings when the user saves an API key. It does not inspect unrelated browsing. |
| Optional custom-map provider access | `https://*/*` is declared optional to support user-selected providers. BPB requests only configured HTTPS hostnames when saving/checking a private source or approving its map access. It does not automatically gain access to all sites. The worker uses saved endpoints only and does not inject scripts or inspect provider tabs. |
| Optional Instagram host access | Requested only by **Match BPB theme** in Settings → Capture & reports → Trip report viewing. The browser grants `www.instagram.com`; BPB registers packaged code only for captioned post/Reel embeds, and activates it only inside BPB's own authenticated wrapper. It styles player chrome; it does not extract captions, media URLs, cookies or browsing history. Ordinary post loading does not require this permission. |
| Optional Gaia GPS host access | Access to `www.gaiagps.com` is requested only when the user clicks **Send to Gaia**. It lets the extension open Gaia's map and supply the saved GPX to Gaia's visible import preview; the extension does not click Gaia's **Save** control. |
| Optional onX host access | Access to `backcountry.onxmaps.com` is requested only when the user clicks **Send to onX**. It lets the extension open onX Backcountry's import page and supply the saved GPX to its visible preview; the extension does not click onX's **Import** control and has no access to `identity.onxmaps.com`. |
| Optional CalTopo host access | Access to `caltopo.com` is requested only when the user clicks **Send to CalTopo**. File selection sends the saved GPX to CalTopo for parsing and object review; the extension does not confirm **Import** or **Save**. |
| Optional AllTrails host access | Access to `www.alltrails.com` is requested only when the user clicks **Send to AllTrails**. It lets the extension open the custom route builder and supply the saved GPX to its visible upload preview; the extension does not click AllTrails' **Upload** control. |

Firefox's `locationInfo` declaration is a data-handling disclosure, not
permission to read device location. It covers:

- activity coordinates sent to Peakbagger for summit lookup and GPS Preview;
- summit coordinates sent to Open-Meteo for historical weather and forecasts
  when an enabled weather card approaches the viewport;
- nearby public SNOTEL station IDs sent to USDA NRCS when an enabled snow card
  approaches the viewport, with summit proximity computed locally;
- viewed-area tile coordinates sent to Mapterhorn, Maptoolkit, or a selected
  compatible map provider when 3D is used;
- clicked-area tile coordinates sent to Mapterhorn after an explicit map
  right-click for the approximate elevation readout, plus that selected point
  sent to applicable visible snow/slope/land providers for their readings;
- a Peakbagger-stored GPS track written to the user's GitHub repository when
  the user backs up an ascent; and
- a Peakbagger-stored GPS track sent to Gaia, onX, AllTrails, or CalTopo when the user clicks that destination's **Send** button.

### Where browser data is stored

| Storage | Contents | Retention and sync |
| --- | --- | --- |
| `storage.sync` | Theme, units, chart, route/map appearance, weather models/metric/card placement, capture, editor, beta-filter, favorite-source and photo-tool appearance preferences | May sync through the browser account; included in settings files and optional GitHub settings backup. No coordinates, weather results or annotation contents. |
| `storage.local` | Device settings (map dimensions, terrain cache budget and GitHub transfer consent), DEM cache index, custom favorites, ignored climbers, Buddy cache/intents, GitHub token/repository, ImgBB API key, report drafts and backup/sync state | Device-local; never browser-synced. |
| `storage.sync` map overlay preferences | Raster opacity percentages and selected public-land type IDs | Included in settings sync, exports and backups. Enabled layers remain in page memory. |
| `storage.local.bpbCustomMapOverlaysV1` and `bpbCustomMapOverlayPreferencesV1` | User-entered overlay definitions, public URLs/keys, attribution, appearance, saved order and opacity | Included in manual settings files and opted-in GitHub settings backups; excluded from browser sync. Manage in Settings → Map layers. Custom enablement, parsed geometry, tile bytes and probe locations are not persisted by the extension. |
| `storage.local` public snow catalog | Public SNOTEL station metadata only, with a fetch timestamp | Refreshed after seven days when next used; expired metadata can remain until replaced or extension data is cleared. No peak/location query or observations; excluded from settings exports, sync and backups. |
| `storage.session` | Capture-job metadata, generation-scoped reduced GPX payloads, prepared drafts, temporary Peakbagger helper leases, validated rate-limit cooldown, save-time backup snapshots, ascent-deletion intents/tombstones, pending GitHub device authorization, and bounded Full Screen overlay handoffs | Map handoffs expire after 30 seconds and are removed on consumption. Capture, draft, snapshot, and deletion records expire after 30 minutes. Helper leases expire; cooldown is removed at its validated retry time. Authorization is removed when it completes, fails, or expires. |
| `storage.session` (onX) | At most 64 saved-ascent source/tab/document identities, attempt cutoffs and delivery outcomes; no GPX or credentials | Automatic authority lasts at most ten seconds after permission approval. Metadata is replaced as capacity is reached or removed when the browser session ends; missing metadata never authorizes a resend. |
| CacheStorage | Bounded DEM response cache | Browser-managed and subject to eviction. |
| IndexedDB | Photo catalog, projects, original and thumbnail image blobs, upload journal, ImgBB delete URLs, and deletion tombstones | Device-local; never browser-synced. |
| IndexedDB `bpb-private-map-sources-v1` | Private map definitions/query parameters, shared request counters and 429 cooldowns | Extension-origin, device-local; never in content-script-accessible storage, sync or GitHub backups. Manual settings files include private definitions and query parameters in plain text, but never counters, cooldowns or approvals. Successfully deleting a layer deletes its private definition; budget records remain to prevent resetting quotas by deletion. Uninstalling clears the store. |
| Peakbagger `localStorage` | Page-specific filter state and the early theme mirror | Remains with the Peakbagger site data. |

## Garmin API activity inbox

Connecting Garmin requests optional access only to
`https://personal.connectapi.garmin.com/*`. Your personal API key stays in
extension-origin IndexedDB on this device. It is excluded from browser sync,
automatic backups, diagnostics and URLs. A manual settings export includes it
only when **Include saved credentials** is checked; that file is not encrypted.
Access tokens stay in worker memory and are never exported.

The popup and toolbar icon can show how many activities are waiting for peak
checks. That number is computed on this device and is never sent anywhere. Only
the **Activity count on toolbar icon** choice travels with your portable settings.

The General **Automatically detect Garmin activities** switch defaults on.
Turning it off hides the activity inbox and stops imports and queued peak checks,
preserving the key, drafts and import history. Settings keeps the Garmin
connection visible so you can **Disconnect** even while imports are off.
Disconnect removes the saved key and stops imports, keeping local drafts and
history. It also attempts to remove optional Garmin host access. Deleting local
Garmin data is a separate confirmed action. Turning imports on does not grant
Garmin access or create a connection.

Connecting or importing a validated Garmin key enables drafts on this device,
including for previously connected keys. The first peak check records your
verified Peakbagger account before downloading or processing routes; later
checks must use the same account. Checks run while the browser is running,
every four hours by default; frequency, recent
lookback (30 days by default) and full history dates are configurable. Manual
only disables automatic scans. Full history checks look for older uploads;
discovery uses activity dates and IDs, not an upload-time watermark. If Peakbagger
is unavailable or requires verification, activities remain queued locally.
Returning to a loaded, active Peakbagger tab resumes queued peak checks using
that tab's session, including in Manual only mode, subject to rate limits.
The extension does not open a tab or solve an interactive challenge automatically.

Garmin sends complete activity summaries and recordings, which can contain
health and device data. The extension immediately projects summaries to ID,
owner, activity type and dates, and decodes only route fields from FIT. Raw
recordings and unwanted fields remain transient in extension memory. Route
processing waits for a suitable existing Peakbagger session. Summit lookup sends
small route-corridor boxes to Peakbagger; every lookup must succeed before
matches appear. Automatic checks do not open or focus provider or Peakbagger tabs.

Pending drafts retain derived ascent values and a privacy-reduced route (up to
3,000 points) in extension-origin IndexedDB until completed or explicitly removed.
They have no automatic expiry. No raw FIT/ZIP, arbitrary source XML or fitness
measurements are persisted. Preparation is limited to 200 activities and 20 MiB;
capacity errors preserve existing items. Minimal source-ID, dismissal and
verified-save receipts remain locally to prevent duplicate proposals. They are
excluded from settings files and sync. Clearing extension data removes the inbox.

**Open selected drafts** creates a fresh 30-minute session handoff. Current
privacy settings are applied again, and Peakbagger receives newly serialized
Preview GPX. Save remains manual. An unverified previous handoff blocks automatic
replacement forms. **Disconnect** deletes the key and requests removal of optional permission while
keeping drafts and history. **Delete local Garmin data** also removes those local
records; neither action deletes Garmin activities or Peakbagger ascents.

## Activity capture

Activity capture is a short-lived, user-started transaction:

1. **Supported tab and settings:** an unsupported page is rejected without
   reading capture settings. On a recognized activity, capture stops before
   provider injection if the authoritative settings read fails. UI defaults
   never authorize capture or become an exported or remote settings backup.
2. **Ownership check:** capture stops before reading coordinates unless the
   activity page unambiguously proves that the signed-in Garmin or Strava user
   owns the activity. Profile and author identifiers are compared on the page;
   only the verdict, provider, and activity id reach the extension.
3. **Peakbagger session check:** a Peakbagger tab verifies the signed-in
   account before the provider page is asked for coordinates. The extension
   does not request cookie-reading permission or copy cookie values; the site
   handles its own signed-in session. A page freshly opened or loaded for
   capture may satisfy the check from a small allowlist of Peakbagger's global
   account-navigation links and their consistent climber ID; ambiguous evidence
   and already-loaded tabs use the live account-page check. No arbitrary page
   text or form data is copied.
4. **Provider export and local analysis:** the response is classified before
   parsing so sign-out, challenge, rate limit, changed response, invalid GPX,
   and no recorded route remain distinct. Raw provider GPX is parsed on the
   activity page. It is
   never persisted, sent to the developer, or forwarded as source XML.
5. **Summit lookup:** the Peakbagger tab makes small bounding-box requests
   derived from the track corridor. At most four Peakbagger requests are active
   across captures. A challenge or rate limit stops sibling traffic; a valid
   retry time may remain in session storage. Every required lookup must succeed
   before results appear.
6. **Prepared drafts:** derived ascent fields and a generation-scoped reduced
   track stay separately in `storage.session`, are bound to the expected tabs,
   and expire after 30 minutes.
7. **GPS Preview:** after the user selects **Open drafts**, Peakbagger receives a
   newly serialized GPX. Trackpoints and waypoints share a 3,000-point limit.
8. **Review and Save:** the extension may prepare GPS Preview, but it never
   clicks a Peakbagger Save control. Publication remains with the user.

The reduced GPX can contain:

- trackpoint latitude, longitude, optional elevation and timestamp, and segment
  boundaries;
- waypoint latitude, longitude, and name, when enabled; and
- an activity or track name only when enabled for multi-peak Trip Info.

It excludes heart rate, cadence, power, temperature, device fields,
descriptions, routes, waypoint elevation/time/symbols, and extension elements.
The Options-only **Remove GPX timestamps** preference removes recorded times
from GPX sent to Peakbagger. Capture results offer **Include timestamps for this
capture** before opening drafts; the choice applies to all selected summits
and locks when opening starts. The next capture uses the default again.
Allowlisted timed and timeless reduced tracks remain in private session storage
under the same 30-minute expiry so this exception needs no provider re-export.
The preference syncs and transfers with settings; exceptions and GPX do not.

Derived form values such as date, ascent times, distance, gain, per-day
statistics, and nights out remain only in the prepared draft until it expires
or is discarded.

There is no capture telemetry. A disabled-by-default developer/test diagnostic
switch can print one local console record containing only allowlisted durations
and aggregate counts. It accepts and persists no provider identity, URL,
coordinates, GPX, page text, response body, cookies, or headers.

## Processing a GPX file you upload

**Attach GPX** uses Peakbagger's native Preview on the current ascent. It sends
the chosen file to Peakbagger without summit processing or the extension's
full capture privacy reduction. When **Remove GPX timestamps** is enabled,
metadata, waypoint, route, and track `<time>` elements are removed on the page
before the file can be attached or saved. **Include timestamps for this file**
restores the original timestamps for that file only; selecting another file
resets the choice. The original disk file is never modified. Other fields and
extensions in an attached file remain included. Existing-ascent edits offer
this attachment path only. Review and Save remain manual.

The optional **Process** action beside Peakbagger's GPS Track field follows the
same rules as activity capture:

- The file is parsed on the Peakbagger page. Raw XML never leaves the page, the
  original file is not changed, and Peakbagger does not receive that source file
  through the extension.
- Only allowed analysis fields reach the background worker: trackpoint
  latitude, longitude, elevation, and timestamp; waypoint coordinates and
  names; and the track name when capture settings allow it.
- Timezone lookup runs offline from the track's starting coordinate using
  packaged `tz-lookup` data.
- Peakbagger receives the same post-login summit-corridor lookups.
- Applying the result replaces the upload field with the privacy-reduced GPX
  and uses the same 30-minute expiry, exactly-once GPS Preview, and manual-Save
  rules as capture.

For multiple summits, the reduced GPX stays in private session storage until
all selected ascents are saved and checked, or the existing expiry/cleanup
rules remove it. After each manual Save, the extension reads the saved ascent,
its Trip selection when needed, and its stored GPX from Peakbagger. It checks
the complete track before preparing the next summit with the same trip ID.

The extension may also fill an empty Ascent Date on a fresh form with today's
date. That happens entirely locally.

## Peakbagger page features

### GPX Analyzer and preferences

- The GPX Analyzer fetches only the GPX linked from the current Peakbagger
  ascent and processes it locally.
- Portable preferences use `storage.sync`; map dimensions and terrain cache
  budget stay in the device settings record. Page-specific filter state and
  the early theme mirror use Peakbagger's `localStorage`.

### Send to CalTopo

- A trusted **Send to CalTopo** click on a saved ascent requests optional access
  to `https://caltopo.com/*` and sends the exact saved GPX through the worker
  to a fresh CalTopo map's file importer. This includes any locations, track
  names, waypoints, timestamps, or other metadata already in that saved file.
- Selecting the file invokes CalTopo's server-side parser. The adapter waits
  for a populated **Import Data** review; confirming **Import** and saving the
  map remain manual. It does not read credentials or unrelated CalTopo tabs.
- The GPX remains in memory and is never retained in extension storage.
  An uncertain transfer requires inspecting the destination; an explicit
  repeat opens a fresh tab rather than sending the file twice to one importer.

onX automatic work has a single ten-second cutoff after optional permission
approval. Silent authentication can finish within that attempt. Manual sign-in
uses an explicit **Continue export** action that rereads the source GPX. **Open
onX** and **Check onX** only focus the recorded destination. The extension keeps
bounded attempt metadata in private session storage so a worker restart or lost
acknowledgement cannot silently replay a possible delivery.

### Send to Gaia GPS

- The button appears only beside a valid saved-track download on a saved
  Peakbagger ascent. A trusted click requests optional Gaia host access, reads
  that exact Peakbagger GPX in the page's signed-in session, and passes it
  through the background worker to a newly opened or validated Gaia map tab.
- Gaia receives the original saved GPX, including any track, route, waypoint,
  elevation, time, and name data Peakbagger's export contains. Better
  Peakbagger does not persist that GPX, inspect Gaia credentials, or send raw
  Garmin or Strava capture GPX through this feature.
- The packaged Gaia adapter uses the visible file importer and waits for a
  non-empty import preview. It never clicks Gaia's **Save** control. If the file
  may have been supplied but the result is uncertain, the extension directs
  the user to inspect Gaia and does not offer a blind retry.

### Sun and Moon calculator

- Peak pages calculate from the already validated summit coordinate. GPX pages
  calculate from the selected route point, its valid timestamp when present,
  and otherwise only a complete saved ascent date plus an ephemeral preview
  time.
- Timezone lookup and astronomy run locally with packaged `tz-lookup` and
  SunCalc code. The displayed Moon position, phase, and illuminated percentage
  use the same selected instant as the Sun position. The calculator makes no
  request, adds no permission or storage key, and does not persist its
  coordinate, date, time, bearing, or result.
- Opening or moving the calculator cannot start 3D or another provider request.
  If 3D is already open, the calculator receives only the accepted map bearing
  so its decorative compass follows the view.
- Sunrise and sunset are astronomical level-horizon events. The result does not
  model terrain obstruction, shadows, weather, smoke, or actual direct light.

### Favorites and Buddy List

- **Buddy List mode:** the extension fetches the signed-in user's own Buddy List
  when its owner-scoped cache is absent or stale, after a requested refresh or
  import, or after a native Add/Remove Buddy action. Visiting the Buddy List can
  refresh the cache from the rendered page without another request.
- The cache stores the owner's id and fetch time plus third-party climber ids
  and displayed names. Its ordinary refresh interval is seven days. A stale
  cache may remain usable after a failed refresh.
- To verify a native Buddy action after navigation, that tab briefly stores the
  target id, intended action, and timestamp in Peakbagger `sessionStorage`.
  The marker is consumed on the next supported page, ignored after five
  minutes, and never copied to extension storage, browser sync, or GitHub. The
  extension verifies the resulting Buddy List before changing custom favorites.
- **Custom mode:** up to 1,500 climber ids, names, added-at timestamps, and
  manual/Buddy provenance stay in `storage.local`. Adding an id or link in the
  list manager fetches the public climber page to verify it. Name-link cards use
  the displayed name and validated profile-link id already on the page; hovering
  performs no network request and stores no browsing history. The list is not
  browser-synced.
- A confirmed Buddy addition can add that climber to custom favorites. A Buddy
  removal changes custom favorites only when **Keep Buddy removals in sync** is
  enabled; only that preference, not the list, uses browser sync.
- Explicit Add/Remove actions in name-link cards and supported native profile
  controls fetch the authenticated profile, submit only the selected Buddy
  control with fresh form state, and read the profile again to verify the saved
  relationship. Native form state stays in memory and is never logged or stored.
  Pending intents retain only owner/target IDs, displayed name, intended action,
  operation token, tab ID and coordination status in local extension storage.
  Confirmed reconciliation removes them; uncertain writes stay protected until
  an explicit status check. A status check never repeats the server write.

### Ignored climbers and report visibility

- An explicit Ignore addition from a name-link card fetches the signed-in
  account's own Buddy List to check for conflicting membership, in either
  favorite-source mode. It updates the existing owner-scoped cache; a failed or
  mismatched response leaves the ignored list unchanged. Unignore needs no
  Buddy request. Buddy changes use Peakbagger's native profile form contract.
- Up to 1,500 climber IDs, displayed names and added dates stay in `storage.local`.
  They are a device preference across Peakbagger accounts. Adding a link or ID
  fetches the public profile to verify it; ignoring on a profile needs no extra
  lookup. Reasons, report content and browsing history are not stored in this list.
- Peak favorite filtering is a separate device-local preference. Temporary reveal
  and full-list overrides live only in the page. The feature conceals selected
  report/ascent presentations; it does not block network requests. Native pages
  and remote media may load before the local preference is applied. Concealed
  players are suspended, and iframe players can restart on reveal.
- GitHub backup/restore is explicit. Two-way sync starts off on new devices
  and uses the repository's `ignored-climbers.json` after local opt-in. An
  existing installation retains its choice. Initial sync keeps both lists,
  and conflicting changes require review before transfer.
  Browser startup, rate-limited manager checks, trailing local-change alarms and
  periodic alarms check only when enabled. Visiting a peak does not request sync.
  `autoFavoritesBackup` does not enable ignored-list transfer.
- GitHub receives only the file kind/schema/export date and entries' IDs, names
  and added dates. Revisions, credentials, Buddy cache, filter/reveal state and
  account-navigation identity are excluded. Baselines, reviewed snapshots and
  interrupted-upload journals remain in local extension storage for reconciliation.
- Public repositories can expose the list. Unignore propagates to the current file
  after successful sync, but older Git commits can retain the previous entry.
  Disabling sync or disconnecting preserves local membership and pending edits;
  it does not delete the remote file or its Git history.

### Trip-report drafts and remote media

- Rich and Markdown report drafts are device-local. They are keyed to the
  climber and ascent or peak, become eligible for cleanup after 14 days, and are
  pruned toward 30 drafts during maintenance. Plain mode does not store drafts.
- A differing local draft is offered for explicit restoration; it never
  silently replaces server text. See the [trip-report editor design](docs/trip-report-editor.md#device-local-trip-report-draft-lifecycle).
- Displaying a user-provided remote image, direct video, or YouTube embed sends
  an ordinary request to that host, including the browser's IP address. Local
  image and direct-video requests use no referrer. YouTube receives only
  Peakbagger's origin as the required embedding-client identifier, not the
  ascent path or query string. Published remote media is also requested by
  readers' browsers.

## Photo topo editor and ImgBB upload (optional)

The photo editor stores the selected image, thumbnail, source metadata,
annotation project, title, caption, and retained alt text in device-local IndexedDB. Pasting into a
Rich text TR stores metadata-free pixels and a local report image reference.
Double-clicking opens a separate editable copy; **Save and return** keeps it local.
Double-clicking a published image opens that image too. The editor reuses its
local source when available; otherwise it reads the HTTPS image URL without
credentials or a referrer, subject to the host's CORS policy and bounded size
and time limits. The host receives the ordinary image request and IP address.
**Upload and replace** replaces the clicked image with the edited upload; it
does not alter the original published image.
Saving the TR uploads its remaining local images before submitting the report. Source image
bytes can contain camera metadata; they stay local and are never uploaded by
Better Peakbagger.

Remembered tool color, opacity and allowlisted appearance defaults are portable
settings included in browser sync, settings files and GitHub settings backup.
These defaults contain no annotation text, pitch content, coordinates or image
data. Canvas dimensions remain local.

Before upload, the editor creates a new JPEG or PNG containing only flattened
pixels. It excludes EXIF and other source metadata, the source file name,
project JSON, local/report identity, API key, and delete URL.

| Topic | Policy |
| --- | --- |
| Local limits | TR pasted images and flattened local report snapshots: at most 16 MiB each. Decodable images: at most 64 megapixels and 16,384 pixels per side. Source processing/storage: at most 128 MiB. Editable bundles: at most 40 MiB. The original file is never changed. |
| Copy and export | **Copy image** writes the flattened PNG to the system clipboard and **Export image** saves it through the browser's download. Neither sends anything to a network service. |
| Upload | After **Upload to ImgBB** or **Upload and insert** in the photo editor, or after the user saves a TR containing pasted local photos, ImgBB receives the flattened image, chosen upload name, the user's API key, IP address, and ordinary request metadata. ImgBB applies its own upload-byte limit. |
| API key | The saved key remains in device-local extension storage. The background worker uses it directly for user-initiated TR photo uploads and gives it only to Better Peakbagger's exact packaged photo page for a direct ImgBB upload; it is never exposed to Peakbagger, another website, GitHub, browser sync, or status UI. Settings → Report photos → Disconnect removes the saved key even with the report editor off. Earlier uploads and local projects stay; an upload already submitted may finish. |
| Catalog | Stores public URLs, source/export metadata and hashes, upload/reachability state, lineage, report references, and local asset availability because ImgBB's v1 API has no account-gallery listing operation. |
| Delete URL | Stored separately in device-local IndexedDB. It is never placed in a report or GitHub backup. Removing a local entry or report reference does not delete the remote ImgBB image. |
| Recently Deleted | Removed items can be restored locally. After 30 days their image and project assets become eligible for pruning; tombstones remain to prevent older backups from resurrecting them. |

The public image URL may be inserted into a report, where Peakbagger and report
readers request it as remote media. ImgBB governs remote retention. Because an
interrupted upload can have an unknown provider outcome, the extension does not
automatically retry and risk a duplicate upload. Clearing extension data or
uninstalling can remove the local library without deleting uploaded images.

The API key can leave local storage only through an upload to ImgBB or an
explicit manual settings export that includes saved credentials, as described
below. Uploads use the user's own key; Better Peakbagger has no ImgBB relay or
developer account.

## Summit weather

### Experimental summit cloud estimates

The independent **Show Summit Cloud Cover** setting controls this peak-page card.
Existing weather opt-outs carry over until the user changes this setting. When
the expanded card approaches the viewport, Open-Meteo receives public summit
coordinates and four nearby sample coordinates, the selected local day's UTC
hour window, pressure-level weather fields and one or two explicit model IDs.
Requests use model terrain elevation, omit credentials and referrers, and send
no account information, page URL, tracks or ascent details. Provider-wide model
update metadata is requested separately. Ordinary request metadata includes IP
address. Model selection is saved in extension settings; profiles stay in page
memory (six entries, five-minute freshness). Date/model changes, Refresh and
returning to an expired visible card can request data again. Collapse, disabling
the feature or page suspension cancels pending work. See
[method and limitations](docs/weather.md#summit-cloud-cover).

### Nearby snow observations

The independent **Settings → General → Show SNOTEL** preference controls the
Nearby snow card on recognized western-US and Alaska peak pages and the
viewport station layer on ascent, peak and Full Screen maps. Existing weather opt-outs are retained for older settings until
SNOTEL is explicitly enabled. When an enabled card approaches the viewport, the
extension obtains the public NRCS station catalog and matches up to three
stations locally within 50 km. Public catalog metadata is cached on this device
and reused for seven days. NRCS receives no summit coordinates, peak identity,
page URL, ascent/climber ID, report, GPX, or account information.

The selected station's requests contain its public station triplet, snow-depth
and snow-water-equivalent element codes, relative hourly/daily date ranges,
period convention and quality-filter options. NRCS also receives ordinary
request metadata, including the user's IP address. Requests omit credentials
and referrers. Observations and station selections stay in page memory, with
up to three station results cached for 30 minutes; they never enter sync,
exports or backups. Refresh, station changes and returning to an expired visible
card may request observations again. Disabling SNOTEL cancels pending snow
work and prevents new requests. The source link navigates to the selected
station's public NRCS report. See [Nearby snow](docs/nearby-snow.md).

### Air-quality forecast

The **Air quality** tab in Summit weather requests a five-day regional forecast
from `air-quality-api.open-meteo.com` only after that tab is selected and the
browser document is visible. Opening the page or using the weather forecast/past
tabs makes no air-quality request. Requests contain latitude/longitude, the
US AQI and PM2.5 fields, and a fixed UTC forecast window, with no credentials,
referrer, summit elevation, route, account or activity data. The provider also
receives IP address and ordinary network metadata. Switching away, hiding the
browser document, disabling weather, or leaving the page cancels pending AQI
work. A selected tab can revalidate on return; there is no background polling.
Results remain in bounded page memory for reuse for five minutes, are cleared on
location changes, and are never written to browser storage. Failed refreshes
retain the labelled loaded forecast for at most 30 minutes before revalidation.
CAMS/Open-Meteo provide regional surface model estimates, not summit observations.

### Forecast and historical weather

**Settings → General → Show weather cards** controls both historical ascent
weather and peak-page forecasts. It is on by default, and the preference may
sync through the browser account and travel with settings exports or optional
GitHub settings backup. Turning it off hides both cards on open pages, cancels
pending requests, and prevents new weather requests and the archive's
Peakbagger summit lookup until enabled again. Weather requests wait for the
current setting to be read successfully.

On saved ascent pages, the weather card automatically reads the matching peak
page on Peakbagger, then requests model estimates from Open-Meteo when the card
approaches the viewport. This works without a GPX and for other climbers’
viewable ascents. Invalid or incomplete dates make no weather request.
The ascent weather card remembers the last explicitly selected archive model
as a portable preference, separately from peak-page forecast/history choices.
Only a packaged model identifier is saved, not an ascent ID, date, coordinates or
weather data. An unsupported model uses Best Match for that visit without
erasing the saved preference. The card can also move between the report and
summary columns. The model identifier, column and placement slot use
`storage.sync` and are included in settings exports and GitHub settings backups.
Moving the card reuses the loaded weather and sends no new request.

On peak pages, **Summit weather** reads summit coordinates and elevation
directly from the current Peakbagger page. One forecast-API request covers sixteen
completed summit-local days and up to sixteen forecast days (today plus fifteen
days), with UTC padding capped at the API's forecast horizon, when the card
approaches the viewport. Switching periods or hourly graphs makes no additional
request. Each period offers a named-model dropdown, initially GFS. The last
choice for each period and the hourly metric tab are portable settings; only
model/metric identifiers are persisted and included in settings files and backups.
Changing models or using **Refresh** makes another request unless that exact selection is cached. Returning to a visible
card after five minutes refreshes expired data unless the previous request failed.

On peak pages, right-clicking the map and choosing **Forecast and archive for
this location** requests weather for that selected latitude/longitude instead.
Opening the menu alone makes no weather request. The selected point uses its
own local date window and the provider's terrain elevation; the summit elevation
is not sent for it. Selected coordinates and weather stay only in page memory,
never settings, sync or backups. **Reset to summit** restores the loaded summit
weather, and a page reload starts at the summit again.

Open-Meteo receives the summit latitude/longitude, summit elevation when
available, date window and weather fields, IP address, and ordinary request
metadata. Ascent weather uses a three-UTC-day window covering the local ascent
date and Open-Meteo's archive Best Match by default, or an explicitly selected
model. Peak weather uses a padded UTC window covering the
sixteen completed local days and today plus fifteen forecast days, capped at the
API's available horizon, with one or two named models selected by our
GFS default or the user's per-period dropdown choices. Both periods
share one request; model IDs are sent to Open-Meteo. Opening the summit card's
**Models & source details** additionally requests public model-update metadata
from Open-Meteo. Those requests send model identifiers, IP address and ordinary
request metadata, with no coordinates, date range or page URL; results stay in
the short-lived per-page memory cache. Weather
requests omit credentials and referrers. No ascent or climber ID, summit name,
report, GPX, track times, account credentials, or page URL is sent to Open-Meteo.
An hourly graph cursor can follow GPX hover or selection using only timestamps
passed locally between the page's extension scripts. Cursor movement makes no
additional network request and persists no track data.
Changing models or clicking Retry makes another request. The ascent archive's
Best Match is one request and does not try other models on failure. Rate limits and network failures do
not trigger automatic retries. Results remain only in a small, short-lived
per-tab memory cache, never browser sync, backups, or persistent ascent history.

Open-Meteo supplies model estimates rather than summit observations. Its
[privacy policy](https://open-meteo.com/en/terms) governs provider logs and
retention, including API logs that may contain coordinates and are deleted
after 90 days. Free hosted API access is for non-commercial use. The card
credits Open-Meteo; underlying datasets retain their provider licences.

## Optional map overlays and 3D terrain

Public custom raster, MVT and GeoJSON overlays use the user's public HTTPS endpoints
directly from the active 2D page or packaged 3D frame. Metadata can discover tile
hosts, but an additional host requires explicit review in the editor. The source
must allow the actual renderer's origin through CORS. **Check source** in Settings
reads metadata without a map location. Tile coverage is checked only by enabling
the source on a map. Missing tiles may request up to two coarser parents.
Downloaded bytes and validated geometry remain in bounded memory caches, cleared
on renderer teardown. Browser HTTP caching remains subject to provider headers.
Adding/editing sources happens in Settings; the map menu link opens that fixed
section only after trusted user activation. Full Screen handoffs carry typed
source IDs/revisions and opacity only, alongside the existing overlay state;
they contain no custom source URLs, URL keys or feature data.

Right-clicking a native or 3D map opens a location readout with coordinates and
an approximate elevation. That explicit gesture requests public Mapterhorn DEM
tiles for the clicked area, even with weather and 3D disabled. Requests contain
only tile coordinates, IP address and ordinary network metadata, omit credentials
and referrers, and have an eight-second total deadline. Missing detail levels
may request up to five tiles. Four decoded tiles and a bounded set of absent
tile keys remain in page memory only; there is no extension-managed persistent
cache for these lookups. Closing the menu, selecting another point or leaving
the page cancels the lookup. Browser HTTP caching may retain tile responses.
The separate forecast action, when the peak weather card is enabled, retains
the Open-Meteo behavior described above; opening the location menu itself makes
no weather request.

The compact Layers menu offers independent overlays in native and supported 3D
maps. Opening it makes no provider request. Enabling slope or public lands
sends tile bounds to USGS 3DEP or PAD-US, with credentials and referrers omitted.
The public-land overlay also uses ParcelMap BC and a regional Alberta government
parcel service when the viewed tiles intersect their coverage. BC requires the
optional `maps.gov.bc.ca` permission, requested only through the explicit
**Allow** action. Its images pass through a bounded extension-worker broker;
if the browser requires activation from extension UI, Allow opens a packaged
permission page whose second explicit click requests access. That page carries
only the source tab ID, transiently, so a grant can refresh the same map.
Page messages contain tile coordinates and allowlisted land-type IDs, never an arbitrary URL. Alberta requests
include tile bounds and only parcel geometry, object IDs and ownership classes,
never owner names or addresses. Neither service receives account credentials,
GPX or route data. Canadian coverage is partial; clear areas mean unknown.
These requests contain no GPX, route, Peakbagger identity or account data.
Opacity and public-land type preferences use browser sync and are included in
settings files and GitHub settings backups; they contain no map location.
Enabled selections remain in page memory, except an explicit native Full Screen
action: a one-use, destination- and tab-bound session handoff lasts 30 seconds
and contains only validated layer state and a Sentinel pass identity.

The **Snow depth** overlay sends the viewed tile bounds to NOAA's public
`mapservices.weather.noaa.gov` snow-analysis service only when enabled and
zoomed into its coverage. It also reads the public analysis valid time and
legend without sending a viewport for those metadata requests. Requests use
HTTPS, omit credentials and referrers, and reject redirects. No GPX, route,
Peakbagger identity or account credentials are sent. Metadata and decoded
images remain in page memory; browser-managed HTTP caching may retain public
images. Turning it off cancels pending requests. Opacity follows the existing
synced overlay preferences; enablement is temporary map state. See
[Snow depth](docs/map-layers.md#snow-depth) for coverage and freshness limits.

An explicit map right-click additionally sends the selected latitude/longitude
only to the services for applicable visible overlays: NOAA for modeled snow
depth, USGS for slope or US fee ownership, and the regional Alberta service for
ownership class. BC parcel point inspection is unavailable. These bounded,
credential-free queries request no parcel owner names or addresses. Their
readings and cooldowns stay in page memory; dismissal and changed layer settings
cancel pending requests. Opening the location menu makes no weather request.

The SNOTEL layer filters the public national catalog locally for the active
viewport. NRCS receives no viewport bounds. More than 50 visible stations asks
the user to zoom in. Only bounded public metadata reaches the renderer; nearby
card actions retain their existing 50 km membership checks.


The **Sentinel-2 (experimental)** layer is also available in the native 2D map.
Selecting it requests the visible map bounds and the last 30 days of capture
metadata from Microsoft Planetary Computer, then natural-color Sentinel-2 tiles
for a selected satellite pass. Map movements repeat that bounded search. The
capture picker can select another pass within that window. No route, GPX,
Peakbagger identity, or account credentials are sent. Catalog results remain in
memory; the extension does not persist satellite imagery or capture metadata.
Browser-managed HTTP caching may retain tiles. Turning the overlay off cancels catalog
requests and removes the extension-owned imagery. Map coverage estimates how
much of the visible map falls within the satellite images. Clouds or gaps may
still obscure covered areas. Cloud cover describes the full satellite images
and can differ from the area shown.

For the vector basemap, deselection or 3D finishing loading removes provider
sources and aborts in-flight requests. Initialized renderer/worker setup and its validated style
may stay in memory for up to 60 seconds per provider for faster reselection;
reactivation requires a fresh one-use capability. Unloading or navigating away
discards that setup. Parked renderers cannot initiate provider requests.
In 2D, rendered cartography is transferred in memory from the extension frame
to the page with its camera coordinates so zoom animations stay aligned.
These pixel buffers contain no native routes, markers, GPX or account data;
they are not persisted or sent elsewhere. Opening 3D lends a copy to the terrain
frame, which shows it until its own tiles arrive and then discards it. The last
displayed buffer stays in memory, hidden, while 3D is open so returning to 2D is
immediate, and is cleared on deselection or when the camera moved off it. At most one image capture is in flight.

**Maptoolkit Hiking (BPB experiment)** is an optional basemap in both 2D and 3D. A
trusted selection sends
direct style, vector/raster tile, glyph and sprite requests to
`styles.maptoolkit.org`, `tiles.maptoolkit.org`, `fonts.maptoolkit.org` and
`icons.maptoolkit.org`. Its elevation shading also requests tiles from
`tiles.mapterhorn.com`, even in 2D. Those services receive the viewed area, IP
address and normal request metadata, with cookies and referrers omitted.
Routes, GPX and Peakbagger identity are not sent to Maptoolkit. The logo is
packaged locally. Normal browser caching applies; the extension keeps no
offline Maptoolkit archive or durable tile cache. See the provider's
[privacy policy](https://www.maptoolkit.org/privacy) and
[Community Terms](https://www.maptoolkit.org/tos).

3D is off by default. The first click shows a provider and privacy confirmation;
declining keeps it off.

After confirmation:

- Mapterhorn receives DEM tile requests for the route, summit area, and later
  map movements.
- Hovering or focusing the enabled 3D button may pre-request Mapterhorn tiles
  for that view. This requires that interaction and never happens merely because
  the page loaded.
- In 3D, Maptoolkit receives requests only when Maptoolkit Hiking is selected.
- A compatible selected Peakbagger map layer may request raster tiles from its
  existing provider for the 3D camera's view.

Tile requests reveal the viewed area and the user's IP address to the provider.
Page messages alone cannot start them: extension code must observe a real
pointer or keyboard action and obtain a short-lived, one-use authorization.
Missing, expired, reused, mismatched, or disabled authorizations start no
renderer or prefetch.

The renderer receives coordinate segments or a summit focus and a bounded map
layer descriptor. It does not receive source GPX, track timestamps, elevation samples,
activity metadata, or Peakbagger identity. DEM responses may be reused from a
bounded local cache. Returning to 2D stops tile activity; the renderer may stay
parked and idle for a few minutes before release, and the cache is not cleared.

### Reported wildfire overlay

**Wildfires** is off in unrelated map sessions. Turning it on requests current
US incident locations and available perimeters directly from NIFC/WFIGS at
`services3.arcgis.com`. Opening Overlays alone makes no fire request. Requests
contain the viewed geographic bounds, fixed wildfire-only filters, selected public
fields and pagination parameters. The provider receives IP address and ordinary
network metadata; requests omit credentials and referrers and send no GPX, route,
account, ascent date or activity data. The active renderer owns its requests;
turning the layer off, switching renderers, hiding the document or leaving the
page cancels work. Settled pans debounce for 300 ms. Visible enabled maps refresh
approximately every five minutes, with bounded pages, response bytes, vertices
and deadlines. Rate limits are retained across renderer switches and Full Screen.
Results stay in page memory only. Each complete component can display independently;
failed refreshes retain dated complete components for at most 30 minutes. An empty
successful response is different from unavailable or incomplete reports. Incident
updates, perimeter observations and perimeter edits keep separate source dates.
Full Screen handoffs carry selection and cooldown only; they refetch fire data.
This is current reporting even on old ascent pages, and does not establish closures,
evacuation boundaries or route access. Canada, smoke and satellite hotspots are not
part of this overlay. US state/DC outlines determine eligibility, with source
completeness and mapping delays still applying within them.

## GitHub connection and backup (optional)

GitHub is disconnected by default. Connecting requires the user to grant host
access, authorize the extension, and select one repository. Ascent and TR backup
is off by default; enabling it also enables backup after each save. Automatic
backups for settings, favorites, and photo metadata start off on new devices.
Each requires its own device-local opt-in; upgrading an existing local connection
preserves its previous choices. Settings imports cannot enable transfers. Backup
never blocks or changes Peakbagger Save.

### What a backup contains

| Backup | Included | Excluded |
| --- | --- | --- |
| Ascent and TR | User-entered ascent fields, Markdown trip report, and Peakbagger's stored, user-approved GPS track | Raw Garmin or Strava GPX |
| `settings.json` | Validated portable settings, custom map sources/opacity (including public URL keys), export time, schema version, and extension version | Saved ImgBB/Garmin/GitHub credentials, repository choice, favorites, drafts, caches, ascents, activity, and GPS data |
| `favorite-climbers.json` | Custom climber ids, displayed names, added-at timestamps, provenance, and export time | Buddy cache and credentials |
| `photo-library.json` | Catalog metadata, public URLs, sanitized source file name, hashes/dimensions, title/caption/alt state, lineage, report references, annotation projects, tombstones, and version/export metadata | Image bytes, ImgBB key and delete URLs, upload journal, transient editor state, and GitHub credentials |

### When a backup happens

- **Ascents and TRs:** after **Back up ascent and TR**, **Back up all ascents and TRs**, or a
  confirmed **Refresh all**; or after each save when ascent and TR backup is
  enabled. Profile runs read each owned ascent from Peakbagger and send one at a
  time. Existing repository folders act as resume checkpoints.
- **Settings and favorites:** after an explicit backup, or after a change when
  that data type's automatic-backup toggle is enabled.
  Both start off on new devices; existing local connections retain their choices.
  Favorites include buddies saved to custom favorites, not the native Peakbagger
  Buddy List cache. Restoring favorites remains a manual action.
- **Photo metadata:** after an explicit backup, or after a catalog change when
  its separate device-local automatic toggle is enabled (off on new devices).
- **Recovery checks:** periodic worker alarms retry pending settings, favorites,
  and photo metadata, including changes missed while a page or worker was closed.
- **Restore:** always requires an explicit Settings action and confirmation.
  Photo restore previews changes/conflicts and restores metadata and annotations
  only, not pixels, thumbnails, or ImgBB deletion capability.

Backups go only to the selected repository. Ascents use named mountain folders
plus a small repository marker; other data uses the fixed root files above. A
populated repository is inspected and requires confirmation before selection,
and unrelated files are preserved. Settings and favorites also require review
before replacing a first-seen or changed remote backup; approvals are bound to
the reviewed snapshots and connection. Invalid remote files are not replaced.
Automatic ascent and TR backup never changes the three root recovery files.

### Deletion, ownership, and authorization

- If **Remove ascent and TR backup files after I delete an ascent** is separately enabled,
  the extension first verifies the ascent is absent from the authenticated,
  complete My Ascents list. It then removes only Better Peakbagger's
  `report.md`, `ascent.json`, and `track.gpx` from the current branch. User files
  and Git history remain. Failed or unconfirmed deletion does not change GitHub.
- Ascent and TR backup appears only for ascents owned by the signed-in climber.
  Full-profile actions also verify the user's My Ascents identity and edit
  access for every parsed row, failing closed otherwise.
- GitHub sign-in uses device flow with a public client id and no client secret.
  Repository scope is selected on GitHub. The token is kept in
  `storage.local`, held by the background worker, never browser-synced, and
  never exposed to a web page. Disconnecting removes the local connection;
  uninstalling the Better Peakbagger GitHub app revokes its GitHub-side access.

## Manual settings files

The user can export and import settings without GitHub:

- **Export settings** downloads an unencrypted JSON file only after a click. By
  default it contains validated portable settings and custom map sources, with
  public URLs, private provider definitions and private request parameters,
  including map API keys. Saved ImgBB/Garmin/GitHub
  credentials remain opt-in. Device
  dimensions, cache budget and automatic-transfer consent are excluded.
- **Include saved credentials** adds the saved ImgBB and Garmin API keys and,
  when connected, the GitHub token and selected repository in plain text.
  The Settings page warns the user to keep the file private and resets the checkbox after each export.
- Import validates the file and requires confirmation before replacing
  portable settings, included custom sources, included API keys, or an included GitHub connection.
  Device settings remain unchanged even when importing an older settings file.
  Private map definitions are restored to extension-origin IndexedDB, not
  content-script-accessible storage. Restored layers stay off and need provider
  permission plus fresh map approval. Request budgets and approvals never travel
  in a file; existing destination provider counters remain in force.
- Before accepting imported GitHub credentials, the extension requests host
  access if needed and verifies the token, account, repository grant,
  writability, branch, and backup-path safety with GitHub.
- A file without credential fields leaves those destination credentials
  unchanged. Explicit null API keys remove those keys. A Garmin key requires
  Garmin host access and validation, and enables drafts on the destination
  device. It does not copy the source device's Peakbagger account binding.
  Access tokens and inbox data are excluded. The extension never uploads the
  settings file.

## Manual climber-list files

Climber lists offers separate JSON export/import for custom favorites and ignored
climbers. Files contain only the list kind/schema/export date and climber IDs,
names, added dates and favorite source where applicable. Import requires a
replacement preview and confirmation, preserves membership rules, and requires
renewed review after concurrent local edits. It does not change Peakbagger Buddy
membership. No GitHub connection is needed; already-enabled automatic list
backup or sync may later transfer the imported change.

## Third-party services

| Service | When it receives data |
| --- | --- |
| Peakbagger | Summit-corridor lookup and user-approved GPS Preview; normal operation of Peakbagger page features. |
| Open-Meteo | Summit coordinates, elevation when available, weather fields and an ascent-day window or sixteen past days plus up to sixteen forecast days when an enabled card approaches the viewport; selecting a map location requests that point without summit elevation. Model selection, Retry, Refresh or an automatic expired-data refresh may request data again. No credentials or referrer. |
| USDA NRCS | Public SNOTEL station catalog, then selected public station IDs, relative date ranges, snow fields, period convention and quality-filter options when the enabled snow card approaches the viewport, changes stations, refreshes or returns with expired data. Local proximity matching sends no summit coordinates; no credentials or referrer. |
| Mapterhorn | DEM tiles after 3D activation, including an interaction-triggered pre-request when 3D is enabled; elevation shading when Maptoolkit Hiking is selected in 2D; or a bounded elevation lookup after an explicit map right-click, independently of 3D/weather settings. No credentials or referrer. |
| Selected map provider | Selected compatible raster-provider tiles in 3D. |
| Maptoolkit | Style, vector/raster tile, glyph and sprite requests only when Maptoolkit Hiking is selected in 2D or 3D. No cookies, referrers, source GPX or Peakbagger identity. |
| NOAA NOHRSC | Viewed-area snow tiles when enabled, public analysis time and legend; an explicitly right-clicked point for visible snow-depth readings. No credentials or referrers. |
| USGS 3DEP / PAD-US | Viewed-area tile bounds when enabled; an explicitly right-clicked point for visible slope/land readings. No credentials or referrers. |
| ParcelMap BC / Alberta Environment and Protected Areas | Viewed-area tile bounds when public lands is enabled in supported Canadian areas. BC images require explicit optional host access and pass transiently through the extension worker. Alberta returns only geometry, object IDs and ownership classes; explicit right-click point queries request ownership class only. No credentials or referrers; no extension-managed persistent parcel cache. |
| Microsoft Planetary Computer | Viewed-area bounds and date range for capture search, and satellite tiles, only while Sentinel-2 is selected in 2D or 3D. |
| ImgBB | A user-initiated flattened image upload and later requests for its public URL. |
| AllTrails, CalTopo, Gaia GPS, and onX Backcountry | The saved Peakbagger GPX after the matching **Send** click, including CalTopo's server-side parsing; review and final Upload, Import, and Save actions remain manual. |
| YouTube or a user-provided media host | Remote report media requested by the editor, preview, published report, or report reader. |
| Instagram | One post after **Load post**, or visible posts after this device opts into automatic loading. No metadata, thumbnail, caption or player request before activation. The isolated provider page may use Instagram cookies subject to browser restrictions; its privacy policy applies. |
| GitHub | User-triggered backups, automatic ascent backups when enabled, and device-opted-in settings/favorites/photo metadata backups and ignored-list sync, all to the selected repository; validation reads for an imported connection; explicit restores. |
| Windy, Copernicus Browser, and AirNow | Only when the user follows the corresponding summit link. |
| Avalanche forecast and backcountry conditions sites | Only when the user opens a planning link. Canada links include the summit coordinates; EAWS map links include a small area around the summit. Other configured destinations are gateways without coordinates. |

Avalanche links are resolved from the peak's displayed coordinates and Nation
row using a packaged source registry. The extension does not fetch forecasts,
prefetch these destinations, embed their pages, or request geolocation. Links
use `noopener noreferrer` and send no peak ID, climber identity, ascent date, or
GPX. Opening a link reveals its URL parameters to the destination; that site's
own data handling applies to subsequent browsing. Country routing helps find
regional bulletins and does not establish forecast coverage or avalanche danger
at the summit or on a route.

All extension code and libraries are packaged locally. YouTube and Instagram
players are remote page content in separate frames; neither is loaded as
extension code or given extension privileges.


## Trip-report reader protection

On saved-ascent pages, BPB adds a restrictive response policy
and rebuilds recognized report cells from safe markup. Chrome uses static network
rules; Firefox uses a response-header listener scoped to Peakbagger documents.
The listener inspects URL/type and response headers only, never response bodies
or cookies. Website policies remain in effect. Cloudflare challenge responses are
excluded so ordinary site validation can run. Known native map frames remain
available. This client-side protection does not change stored reports or protect
people who do not run BPB. Instagram resources initiated by Peakbagger are blocked
by default, without inspecting their contents.

Instagram authoring stores a canonical ordinary post link. Pasting Instagram's
embed code extracts only that link; supplied HTML and scripts are discarded.
**Load Instagram posts automatically** defaults off and stays in this device's
local settings, outside browser sync and settings backups. Turning it off
unloads existing players. A manual load applies to one post instance for the
current visit; leaving or hiding the surface unloads it.

A one-use loading grant contains the canonical post URL and source tab/document
identity in extension session storage. It expires after 60 seconds; unused,
expired records are removed on the next grant/claim or tab cleanup, and all
session records disappear when the browser session ends. It is consumed by the
packaged wrapper, invalidated on navigation/tab closure, and never sent to
Instagram. The provider receives its post URL through a no-referrer sandbox
that permits scripts and retains only Instagram's own origin, so its video
loader can make same-origin requests. It remains cross-origin from the packaged
wrapper and Peakbagger, without access to the Peakbagger document,
extension APIs, popups, forms or top-level navigation. BPB performs no oEmbed API
lookup, proxying or provider-content scraping. The persistent network rule blocks
Instagram resources initiated by Peakbagger; loading a post never unlocks the
whole tab. Protection does not cover readers without BPB or a pre-existing
hostile service worker synthesizing documents outside the network stack.

After loading, Instagram's captioned player displays the author's caption inside
the sandbox. BPB does not read, extract or store that text. A bounded numeric
height measurement crosses from the actual provider frame to the packaged
wrapper, then to the report surface; it determines one initial layout expansion.
The optional display helper additionally sends a content-free readiness signal
to the wrapper.
Provider markup, styles and later resize messages are not applied to the report.

**Instagram theme** is a separate optional browser permission, not
automatic-loading consent. After granting it, reload an open post to apply the
helper. It matches the post's chrome to BPB's theme without filtering photos or
video. Carousel navigation is left entirely to Instagram.
The isolated helper remains inactive on standalone Instagram pages and embeds
outside BPB's own packaged parent. Only an authenticated light/dark/enabled
configuration and a readiness signal cross that boundary; provider content is
not sent to the worker or report. Removing access unregisters the helper and
restores native presentation in open BPB embeds. Permission state is owned by
the browser and is not copied into settings backups or browser sync.

## Private map request boundary

The overlay editor recognizes URL hints locally. It contacts a source document
only after Check source or an automatic Save; typing/pasting does not send a
request. Discovery reads the supplied URL without searching for other endpoints
or crawling tiles. The same bounded source-field reader serves public CORS
checks and Settings-only private checks. Private metadata, parameters and signed
URLs remain inside extension surfaces during detection. Additional tile hosts
still require review; detection cannot approve a map's private request allowance.

Adding private query parameters moves that source’s GET requests into BPB’s
background worker. The full definition and values stay in extension-origin
IndexedDB. Public records and MAIN-world messages contain only opaque
layer/revision/resource descriptors; they contain no actual provider URL or key.
Settings-only editor replies can edit private values; an editor embedded by
Peakbagger cannot. Values are masked in the form, not encrypted against someone
controlling the browser/device. Manual settings exports include these values
and private URLs by default in an unencrypted JSON file. Automatic GitHub backups
exclude them; restoring those descriptors or older files requires reconnecting
locally. Current manual files restore validated definitions without copying any
approval, cooldown or request budget.

Map requests need explicit approval in a full BPB page, bound to a tab, layer
revision and navigation lifetime: 20,000 attempts for 8 hours. Native MasterMap
children and the authenticated 3D frame in that tab share it. Navigation/reload,
tab closure, definition changes, permission removal and worker restart end
approval. Only the active tab can request new data. Shared durable limits are
four jobs, 25,000 attempts per hour and 100,000 per day per configured provider
hostname. Failures count; clock rollback cannot reset counters. An authorized
hostile page can consume its approved allowance: this bounds spending, not
all quota risk. No generic URL/header/method fetch endpoint exists.

The worker constructs URLs from saved definitions and validated resource kinds
and integer tile coordinates. It rejects redirects, omits cookies/referrers,
and attaches query values only to the original input origin. Other TileJSON
hosts require review/permission and never inherit those parameters. Metadata
responses expose validated source fields only; signed tile URLs stay private.
Per-format byte limits remain; a 16 MiB worker cache and shared duplicate GETs
reduce spending. Cancelling all consumers or revoking access aborts transports.
HTTP 429 applies a shared cooldown. No automatic network retry is added.

The configured provider receives the key, network metadata and viewed tile
coordinates. Its returned map content and access policy must be trusted. No
localhost server or remote proxy service is installed. Browser permission
warnings cover a hostname; BPB further confines each GET to saved HTTPS origins
and resource paths. See [map layers](docs/map-layers.md#private-request-parameters).

Removing parameter rows does not declassify an existing private layer or its
signed metadata URLs. A public version must be added as a separate public
definition after reviewing the URL; deleted private definitions are removed
from the private store on successful deletion.