Privacy Policy
This policy explains exactly what the Xmlbar browser extension does with your data. In short: everything happens on your own computer, and nothing is sent to us.
No collection, no servers, no tracking. The Extension does not create accounts, does not use cookies, analytics or telemetry, and does not transmit your browsing data, page content or the media links it detects to any server operated by us or by a third party.
The only outbound connection the Extension ever makes is to a program running on your own machine, at http://127.0.0.1:8325.
This Privacy Policy applies solely to the Xmlbar browser extension (the "Extension") distributed through the Microsoft Edge Add-ons store and the Chrome Web Store, and identified in the store listing as Xmlbar Media Probe / 稞麦浏览器探针.
"We", "us" and "our" refer to the developer of the Extension. "You" refers to the person who installs and uses it.
This document does not describe a website. The xmlbar.net website and the Xmlbar desktop application are separate products with their own privacy practices, and this policy makes no statement about them. Wherever this policy says "the Extension", it means the browser extension and nothing else.
| Question | Answer |
|---|---|
| Do you collect personal data? | No. No accounts, no registration, no identifiers. |
| Does any data reach your servers? | No. We operate no server that the Extension talks to. |
| Do you use cookies, analytics, telemetry or advertising? | No. None of these are included in the package. |
| Do you read page content? | Only to extract media URLs (video and audio stream addresses) from the page you are on, and to read HLS playlist text so the desktop app can identify stream qualities. No other content is read. |
| Do you sell or share data with third parties? | No. Not sold, rented, traded or shared. |
| Do you load remote code? | No. All code ships inside the package. |
| Can I delete the data you hold about me? | There is no such data. Everything the Extension touches stays in your browser's memory and disappears when the tab or browser closes. |
The Extension has a single purpose, as declared in its store listing:
Transfer the video page the user is currently viewing to the locally installed Xmlbar desktop downloader, so the desktop app can resolve the available video qualities. The extension does not download media itself and does not contact any remote server.
Practically, that means the Extension:
The Extension does not download media files, does not bypass paywalls or DRM, and does not talk to any server on the internet. All page parsing and downloading is performed by the desktop application, not by the Extension.
The Extension requests the following permissions. Each one exists to make the single purpose above work, and none is used for anything else.
| Permission | Why it is required |
|---|---|
storage |
Cache the detected media list per tab so the popup renders instantly when reopened. Session-scoped only — see section 8. |
tabs |
Read the active tab's URL and title to pass to the local client, and to show a per-tab badge count. |
contextMenus |
Provide three right-click items: "send this link", "send this media" and "send this page" to Xmlbar. |
webRequest (observing only) |
Inspect response headers such as content-type and content-length to tell media streams apart from ordinary traffic. Response bodies and credentials are never read. |
<all_urls> (host access) |
Video can be served from any domain, so the request observer must be able to see all requests in order to identify streams. Observed URLs are only ever sent to the user's own machine at 127.0.0.1, never to us. |
http://127.0.0.1/*, http://localhost/* |
POST the payload to the desktop client's local bridge on port 8325. |
Content script (fetch / XMLHttpRequest hook) |
Read m3u8 playlist text, which reveals AES-128 encryption and variant bitrates. webRequest cannot read response bodies. The hook is read-only and does not alter page behaviour. |
The Extension handles the following items. All of them are processed in your browser, on your computer. None is transmitted to us.
| Data | Source | Destination |
|---|---|---|
| URL and title of the tab you are viewing | tabs permission |
Shown in the extension panel; included in the payload only when you choose to send that page to Xmlbar. |
| Detected media URLs (video / audio stream addresses) | Network response headers and links found in the page | Listed in the panel; sent to the local bridge only when you click "Send to Xmlbar". |
| Stream metadata (content-type, content-length, HLS playlist text) | webRequest headers and the read-only script hook |
Used to label and group streams in the panel. Kept in memory only. |
| Per-tab media list | Produced by the Extension itself | Browser session storage, so the popup can render immediately. Never leaves the device. |
Nothing in this table is aggregated, profiled, fingerprinted, or associated with an identity. The Extension has no concept of a user account, so it has nothing to attach such data to.
When you ask the Extension to send something to Xmlbar, it makes an HTTP request to http://127.0.0.1:8325 — a loopback address that refers to your own computer and cannot route to the internet. The listening side is the Xmlbar desktop application, which you install and run yourself.
The desktop application is a separate product, installed by you, and is governed by its own documentation and privacy practices. This policy covers the Extension's side of that exchange only.
To be unambiguous, the Extension does not:
The Extension uses session storage (chrome.storage.session), which is held in memory for the duration of the browser session and is not written to disk in readable form. It is used for one thing: the list of media streams already detected for each open tab, so the panel can render instantly instead of re-scanning.
Because nothing is transmitted to us, there is no server-side retention period to describe. We hold no copy of anything, at any time.
We do not sell, trade, rent or transfer your data to outside parties. This includes affiliates, service providers, advertising networks, data brokers and any successor entity. The Extension contains no third-party SDK that could receive data.
We also do not transfer data in connection with a merger, acquisition, reorganisation or sale of assets, for the simple reason that we do not hold any data to transfer.
All code executed by the Extension is included in the submitted package. The Extension does not fetch, evaluate or execute scripts from remote sources, and does not use eval or similar dynamic-execution mechanisms to load code over the network. Page parsing is performed by the desktop application, not by the Extension.
Privacy laws such as the GDPR and the CCPA give you rights to access, correct, delete, port and object to the processing of your personal data. Those rights apply to data an organisation holds about you. We hold none. There is no account to inspect, no profile to correct and no server record to delete, so there is nothing for us to export or erase on request.
You remain in full control on your own device:
edge://extensions or chrome://extensions. Removal deletes its session storage immediately.If you believe the Extension has behaved inconsistently with this policy, please contact us — see section 14. We will investigate and, where a fix is needed, publish it through the store.
The Extension is a utility for downloading publicly available media and is not directed at children. Because it collects no personal data from anyone, it does not knowingly collect personal information from children under 16 (or under the higher age set by applicable local law).
If the Extension's data handling ever changes — for example, if a future version added an optional online feature — this policy will be updated before that version is published, and the effective date at the top of the page will change. Because the Extension cannot contact you (it has no accounts and no messaging channel), the current version of this page is the authoritative record. Continued use of a version of the Extension released after a change constitutes acceptance of the updated policy.
Questions about this policy, or about the Extension's behaviour, can be sent to:
以下为上述内容的中文摘要，便于中文用户阅读。若中英文表述存在差异，以英文版本为准。
本政策只适用于「稞麦浏览器探针」浏览器扩展，不适用于 xmlbar.net 网站，也不适用于稞麦桌面客户端。
扩展不收集任何个人数据。没有账号体系，不使用 Cookie，不做统计分析，不上报崩溃日志，不投放广告，不与任何第三方共享或出售数据，也不加载远程代码。
扩展在本地处理的数据：当前标签页的网址与标题、页面上检测到的媒体地址、响应头中的 content-type/content-length 以及 HLS 播放列表文本。这些只用于在面板中列出可用清晰度。
唯一的"对外"连接指向 http://127.0.0.1:8325，即你本机安装的稞麦客户端，属于本机回环地址，无法访问互联网。只有你在面板中点击"投递到稞麦"时，网址或媒体链接才会发送给它。
存储与保留：检测结果存放在浏览器会话内存中，按标签页隔离，最多保留最近 150 条，超过 30 分钟自动失效；切换网址、关闭标签页、关闭浏览器或卸载扩展即清除。我们不保留任何副本。
如需停止扩展，在 edge://extensions 或 chrome://extensions 中停用或移除即可。如有疑问请联系 xmlbar@gmail.com。