At a glance

Your working layout is local to Firefox. Firefox Sync is optional. MosaicSync does not sell data and does not operate a synchronization server.
Local state

MosaicSync stores its working state in Firefox extension storage. This can include shortcut names and URLs, folders, positions, appearance settings, local artwork caches, and local synchronization metadata. browser.storage.local remains the durable local copy. Disposable browser-session caches may use browser.storage.session and can be cleared without losing authoritative MosaicSync state.

The optional manual UI-language preference is device-local and stored only in extension-origin localStorage. It is not part of the MosaicSync layout and is not synchronized to other computers.
Firefox Account Sync

Firefox Account Sync is optional. If enabled, MosaicSync writes supported layout records to Firefox browser.storage.sync; MosaicSync does not send them to a developer server. Shortcut URLs/titles, folder names, layout, supported settings, and only explicitly selected compact custom-artwork derivatives may be included. Reconstructable/site-learned artwork remains outside MosaicSync's binary Sync artwork budget.

A lightweight repeating Firefox alarms event checks the already-delivered local storage.sync cache for new commits while Sync is enabled. It does not contact a MosaicSync server and does not force Firefox Account Sync network traffic.
Optional Firefox bookmarks access

Firefox's bookmarks permission is declared as optional. MosaicSync requests it only after the user explicitly opens Bookmarks and chooses to allow access.

When granted, MosaicSync reads the Firefox bookmark tree using browser.bookmarks.getTree() and displays it in a read-only panel. Bookmark folders, titles, and URLs are held in memory only while that panel is open. MosaicSync does not create, rename, move, or delete Firefox bookmarks, and it does not copy bookmark data into MosaicSync state, browser.storage.local, or browser.storage.sync.

The Bookmarks viewer renders only normal HTTP/HTTPS bookmarks as clickable web links. Bookmarklets and local/file URLs are not exposed as navigable links in this panel.
Optional website access

MosaicSync declares optional host patterns for HTTP and HTTPS websites. They are not required at installation. Website access can be requested from a user gesture for automatic site icons and user-requested web artwork. There are no content scripts; MosaicSync does not collect page text for profiling or transmission.
Firefox New Tab shortcut import

If the user explicitly imports Firefox's current New Tab shortcuts, MosaicSync requests Firefox's optional topSites permission and reads the ordered New Tab list returned by Firefox. This is separate from the Bookmarks feature.
Data collection

MosaicSync does not sell data. It contains no developer analytics SDK, tracking pixel, advertising SDK, or telemetry upload endpoint. Firefox Sync is the only synchronization transport.

MosaicSync is open source and free to use, copy, share, and modify under MPL-2.0.