Lightstreamer Workbench Privacy Policy

Canonical policy: https://imom39a.github.io/lightstreamer-workbench-extension/privacy/

Lightstreamer Workbench is a developer-tools extension for inspecting the official Lightstreamer Web Client in the currently inspected tab. Firefox 2.0.9 targets desktop Firefox 140+ on Windows, macOS and Linux. Private browsing is disabled.

Inspected application data

Workbench observes clients, Sessions, Subscriptions, Item Updates and field values, snapshots, COMMAND keys, outbound Client Messages and their outcomes, diagnostics, and Injection Sources and Drafts. Capture does not alter the application's original updates or messages. The data belongs to the current inspected tab and Panel Session. Client IP addresses supplied by the Lightstreamer client are masked before Capture. Captured Evidence is not sent to maintainers or Google Analytics.

Application fields may contain website content, browsing activity, personally identifying information, health information, financial and payment information, authentication information, personal communications, and location information. Workbench cannot determine arbitrary fields' business meaning. Recognized credential redaction does not guarantee these categories are absent.

Agent/MCP access

Firefox installation requires native consent for sharing these application-data categories with the local companion and configured MCP client/model provider. Agent access is On by default in each new Panel Session and connects automatically to the local companion. Use More actions → Agent access and setup to turn it Off. A new panel uses the defaults; the panel does not persist an access preference or connection configuration.

Agents may request retained Evidence, diagnostics, runtime Scope and Draft/Scenario outcomes. The interface redacts Client Message bodies and outcome text, recognized credential-named fields, and URL query strings and fragments. Other values and inspected-page origin/path can remain private application data. Requested data leaves the extension for a local process and may reach your configured model provider under that provider's policies. The companion does not persist Evidence or log payloads. Maintain control of your MCP client and model-provider configuration.

The Node.js companion binds only to 127.0.0.1 on port 24817. Transport is an unencrypted local WebSocket. Authentication is Off: any local process that reaches the companion can use a connected panel's grant or impersonate the companion. Origin checks do not isolate OS users or local processes. Use a trusted development computer. Turning Agent access Off revokes access and pauses an agent Scenario; it cannot undo an update already sent. Reconnection does not repeat operations or resume a Scenario automatically. Unknown delivery is not retried automatically.

One companion supports Chrome and Firefox, including multiple Firefox profiles. It reads bounded local Firefox profile-registry and prefs.js UUID mappings to verify the approved add-on origin, lightstreamer-workbench@imom39a. It does not execute preferences or transmit those files. Setup prints MCP configuration; it creates no native-host registration, credential file, OS service or remote listener. npm's cache contains code, not Evidence.

Optional usage analytics

Firefox analytics starts Off. It sends only when both Firefox's optional technical-and-interaction data permission and Workbench's Share usage analytics setting allow it. The control is under More actions → Help & resources → Usage analytics. Cancel or Deny saves Off. The choice is remembered in that browser profile; reopening Workbench does not ask again. A new request requires explicitly enabling analytics while native permission is missing. Granting native permission does not override a saved Workbench opt-out.

Google Analytics 4 receives fixed feature/screen names, coarse outcomes and error categories, extension version, event time, foreground engagement duration, and a random pseudonymous installation identifier. No browser fingerprint or named account is created. Captured Evidence, inspected URLs, typed text, Drafts and raw errors are excluded. Analytics is not used for advertising; advertising personalization and advertising user-data use are denied.

The preference and identifier use extension-local storage. Analytics session information uses browser-session storage and expires after thirty minutes without activity. Opt-out or native permission removal stops sending, aborts an active request where possible, discards queued events, and removes the analytics identifier and session. There is no saved event queue or later backlog upload. Missing configuration or unavailable storage pauses collection without blocking debugging. Previously received events cannot be retracted from Google. Google also receives the network IP address used for the HTTPS request. See https://policies.google.com/privacy and the canonical policy for Google processing and retention.

Temporary history, cleanup and exports

Each Panel Session owns one temporary rolling Event History. IndexedDB retention is 100,000 records or 256 MiB; memory fallback is 25,000 records or 128 MiB. Limits remove the oldest accepted prefix while Capture continues. After bounded commit recovery fails, the session uses bounded memory and reports the reduced capacity. A controlled Close stops intake, commits accepted work and attempts erasure, reporting the outcome. A crash, renderer stop, extension reload or blocked cleanup can leave residual data until ownership-safe cleanup. A new Panel Session starts empty. Cleanup never loads old Evidence as application state.

JSON/offline HTML exports and clipboard copies are deliberate local user actions. Exports exclude connection credentials; structural exports omit Client Message bodies. Bulk Evidence copies redact message bodies and outcome text. Other application values can remain private; review artifacts before sharing. Opening and copying a complete raw event is a deliberate local action.

Injection and network

Local Injection delivers a marked update through captured application listeners. It does not contact Lightstreamer Server, but listeners may cause app actions. Server Injection requires review of the exact message and send arguments, then one call through the page-owned client's normal sendMessage path. It does not create an inbound Server Update. A Processed outcome does not prove a business effect. Unknown outcomes are not retried automatically.

Packaged background code sends analytics to https://www.google-analytics.com/mp/collect only while both gates allow it. No remote executable analytics SDK is loaded. The inspected application's own network traffic belongs to that application. There is no advertising, Workbench account sign-in or maintainer-operated collection server.

The separate public documentation website uses a separate Google Analytics web stream and website opt-out. Its analytics settings do not change extension preferences; the canonical policy describes that website separately.

Use Workbench only on pages you may inspect. Do not share production payloads, exports, screenshots, customer data, credentials or private URLs in public support reports. Support: https://imom39a.github.io/lightstreamer-workbench-extension/support/