https://browsergotchi.com/privacy

This extension is built with plain HTML, CSS, and ES modules — no bundler, no build step, no transpilation. What you see in the zip is exactly what runs in the browser. No source code submission is needed.

The extension uses innerHTML and insertAdjacentHTML in several UI files (shop, games, friend list). All values are constructed from internal state objects and hardcoded SVG/HTML strings — no user input is ever interpolated into these calls. The linter flags them automatically but they pose no XSS risk in this context.

Optional account features (login, state sync) communicate with https://browsergotchi.com, operated by diedigitale.at. No data is collected unless the user explicitly creates an account.