firefox-ctl is a bridge between Firefox and a command-line program running on the same computer. It has no server, opens no network connections of its own and collects no telemetry.

WHAT LEAVES THE BROWSER

When a command is issued from the terminal, the add-on sends the answer to the local firefox-ctl native host over native messaging (stdio), and that program prints it on the terminal of the user who issued the command. Depending on the command, that answer can contain:

• Browsing activity: the URLs, titles and ids of tabs and windows the add-on manages or is asked about.
• Website content: page text and HTML, accessibility snapshots, screenshots, console output, and the metadata of network requests the page made. Credential-looking query parameters are stripped from logged URLs; credential-bearing response headers are replaced by "[redacted]" unless the user turns that off in the add-on preferences.
• Website activity: the result of clicks, typing, key presses and scrolling the terminal asked for.
• Authentication information: if the terminal types into a password field, reads a form that contains one, or evaluates an expression over it, the value of that field is part of the answer.

The arbitrary-JavaScript command (evaluate) is disabled by default and can only be enabled by the user in the add-on preferences.

WHAT IS STORED

The add-on keeps the ids of its managed window and attached tabs in the browser's local extension storage so that it can re-adopt them after a restart. It never stores page content, and it stores nothing at all about private browsing windows. A short in-memory log of recent network requests exists while the browser runs and is gone when it quits.

WHAT IS SHARED

Nothing is sent to the developer or to any third party. The only recipient of any data is the firefox-ctl program the user installed, on the user's own machine.

Contact: a.v.iatsiuk@gmail.com