Arca transmits no data to any third party, and contains no analytics
or telemetry. It talks only to an Arca backend whose address you
configure; by default this is a private cloud service the developer
runs. The developer has no access to any other person's data. The
backend requires an account and registration is closed, so the
extension cannot store anything for anyone but the developer.

When the optional auto-save feature is enabled, Arca reads image URLs
and the post permalink from posts you explicitly like, bookmark, or
save on x.com and pinterest.com. It downloads those images and uploads
them, with their source URL, to a backend server whose address you
configure yourself, by default the developer's private cloud service.
Nothing is sent anywhere else. Auto-save is disabled by default and is
enabled per-site in the extension's popup.

Arca can also, when you click "Save likes since last" in its popup,
open your own X likes page and scroll it, reading the same image URLs
and permalinks from posts you liked since the last time you ran it.
This never runs on its own and never reads any timeline other than
your own likes.

Arca stores locally, in your browser: your backend URL, a personal
access token, a cached list of your board names, a record of which
images have already been saved, and a queue of pending uploads. The
access token and backend URL use browser.storage.sync so they follow
your Firefox account across your own devices; everything else is
device-local.

Arca contains no analytics, no telemetry, no advertising, no
third-party SDKs, and no remotely-loaded code.