chore: add privacry policy

extension/output/manifest.json

@@ -3,14 +3,7 @@
   "description": "Nostr Signer Extension",
   "version": "1.0.0",
   "homepage_url": "https://git.reya.su/reya/nostr-connect",
-  "manifest_version": 2,
-  "browser_specific_settings": {
-    "gecko": {
-      "data_collection_permissions": {
-        "required": ["none"]
-      }
-    }
-  },
+  "manifest_version": 3,
   "icons": {
     "16": "icons/icon16.png",
     "32": "icons/icon32.png",
@@ -19,19 +12,25 @@
   },
   "options_page": "options.html",
   "background": {
-    "scripts": ["background.build.js"]
+    "service_worker": "background.build.js"
   },
-  "browser_action": {
+  "action": {
     "default_title": "Nostr Signer",
     "default_popup": "popup.html"
   },
   "content_scripts": [
     {
       "matches": ["<all_urls>"],
-      "js": ["content-script.build.js"]
+      "js": ["content-script.build.js"],
+      "all_frames": true
     }
   ],
   "permissions": ["storage", "activeTab", "windows"],
   "optional_permissions": ["notifications"],
-  "web_accessible_resources": ["nostr-provider.js"]
+  "web_accessible_resources": [
+    {
+      "resources": ["nostr-provider.js"],
+      "matches": ["https://*/*", "http://localhost:*/*"]
+    }
+  ]
 }

privacy-policy.md

@@ -0,0 +1,10 @@
+Privacy Policy
+==============
+
+**Nostr Signer** doesn't collect any personal data, doesn't track websites you visit, doesn't collect any form of usage analytics, doesn't sends any information to any service over the internet -- in fact, it doesn't even have a server anywhere, it's just an extension installed in your computer.
+
+The only places **Nostr Signer** sends information to are the URL endpoints you define in the settings page for the extension, the URLs that identify the Lightning nodes you want to talk to, which **Nostr Signer** assumes are under your control or under the control of a third-party you trust.
+
+**Nostr Signer** stores only the information you explicitly write in the settings page: _node URL_, _username_ and _password_ (where applicable). That information, however, is only stored in your own browser, using the _local_ storage mode, not the _synced_ storage mode that saves data to a browser-determined sync server. So if the guarantees offered by the browser itself hold true _that information never leaves your browser_.
+
+For more information on the browser guarantees on which **Nostr Signer** depends, please read Firefox's [Privacy Policy](https://www.mozilla.org/en-US/privacy/websites/) and [Terms of Service](https://www.mozilla.org/en-US/about/legal/terms/mozilla/) and Google Chrome [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://ssl.gstatic.com/chrome/webstore/intl/en-US/gallery_tos.html).