Arca — DangerCat

Arca is a personal image-organization tool I built for my own use.
It saves images into a private backend service I run in the cloud
(on AWS).

Heads up: this extension is not currently useful to anyone but me.
The backend it talks to is private and account-gated. There is no
open registration, and I haven't released the server (I may
open-source it later). If you install this extension today it will
reach my backend, but every request is rejected because you have no
account: no boards load and nothing can be saved. The only thing
that ever reaches my server from a stranger's install is an
unauthenticated health check. No images, no browsing data, and
nothing about you is stored, and I have no way to see who you are.

The reason it's published publicly on AMO rather than unlisted is
so Firefox Sync auto-installs it across my own Firefox instances
(laptop + desktop + work machine) without manual drag-and-drop each
time I update. Unlisted add-ons don't sync.

What it does when the backend IS running:

• Right-click any image → "Keep in Arca" opens a small board-picker
  popup with keyboard shortcuts for quick saving.
• Optional auto-save: liking or bookmarking a post on X/Twitter, or
  saving a pin on Pinterest, sends that post's still images to the
  backend's unsorted queue for filing later. This is OFF by default
  and is turned on per-site in the extension popup. Videos, GIFs,
  avatars and quoted posts are skipped.
• Likes catch-up: a button in the popup opens your own X likes page
  and scrolls it, collecting images from posts you liked since the
  last time you ran it. This exists because likes made on a phone,
  or in an app's built-in browser, never reach auto-save. It runs
  only when you click the button, and stops at the point the previous
  run finished.
• Upgrades the image URL to the highest-quality variant on Twitter
  (?name=orig), Pinterest (largest srcset candidate), and Tumblr
  (_1280) before fetching.
• Offline queue in browser.storage.local drains when the backend
  is reachable again.
• A personal access token authenticates every request against the
  user's own backend account; the token is stored in
  browser.storage.sync so it rides Firefox Sync between the user's
  devices.

Permissions explained:

• *://*/*: needed so fetch() can download image bytes from any
  CDN with the user's logged-in cookies applied; many image hosts
  refuse hotlinked requests. fetch() is only ever called with (a) an
  image URL, and (b) the user's configured backend URL (which
  defaults to the developer's private Arca service).
• Content scripts on x.com / twitter.com and pinterest.com
  (plus the .co.uk and .ca Pinterest domains): these power the
  optional auto-save feature. When you like or
  bookmark a post on X, or save a pin on Pinterest, the content
  script reads the image URLs out of that one post's DOM and hands
  them to the extension's background script, which downloads the
  images to your own backend. These scripts read only the post you
  acted on. They do not read your feed, your direct messages, or
  your account details. They inject nothing into the page, modify no
  page behaviour, and do not run in iframes. Auto-save is off by
  default.
• A further content script on your own likes timeline only
  (x.com/i/history/likes, and the older x.com/<your-handle>/likes
  that X now redirects there): this powers the likes catch-up button.
  When, and only when, you
  click that button, it scrolls your own likes page and reads image
  URLs and permalinks from the posts it passes, stopping at the
  point your previous run finished. This one does read a timeline,
  by design: your own likes, which is the only place a like made on
  another device can be found. It reads no other timeline, and does
  nothing at all unless you click the button.
• webRequest: observes (never blocks or modifies) the site's own
  save/like API call, so auto-save only fires once the action has
  actually succeeded server-side rather than on an optimistic click.
• storage: caches the board list, persists the queue of pending
  saves, and stores the backend URL and the access token.
• contextMenus: adds the "Keep in Arca" right-click item.
• alarms: periodic board refresh and queue flush.
• notifications: toast on manual save/failure. Auto-saves are
  silent.

No telemetry, no analytics, no third-party services, no
remotely-loaded code. The only server the extension ever contacts is
the Arca backend the user configures (by default the developer's own
private cloud service), and image bytes travel only between the source
CDN and that backend. The developer receives no data about any other
user: the backend is account-gated with no open registration, so a
stranger's install can store nothing.