WebWordlist Recon does not collect, transmit, sell, or share any data with the
developer or any third party. Everything happens locally, inside your browser.

• It is inactive by default. It only reads page content after you
  explicitly click "Start capture" in the popup.
• While active, it reads visible text, alt attributes, placeholders,
  aria-label values, meta tags, and email addresses / username-like URL
  fragments from the pages you browse — scoped to a single target domain
  unless you choose "Everything I visit".
• This data is held only in the extension's background page memory, for the
  duration of your browsing session.
• When you click "Export wordlists", three plain-text files (words.txt,
  usernames.txt, passwords.txt) are generated on your device and saved to
  your Downloads folder through Firefox's own download mechanism.
• Clicking "Reset session", reloading the extension, or closing Firefox
  permanently discards all captured data.

• No network requests of any kind are made by the extension itself.
• No analytics, telemetry, crash reporting, or third-party libraries are
  included.
• No data is ever sent off your device, to the developer or to anyone else.

The extension needs the http://*/* and https://*/* permissions because it
must be able to run on whatever site you are currently assessing — the target
is different for every audit. Granting the permission does not mean data is
read: the content script only reports data to the extension when you have
explicitly turned capture on for that session.


WebWordlist Recon is a security-testing utility intended for authorized
security assessments — i.e., only against systems and
web applications you own or have explicit permission to test. Do not use it
against systems you are not authorized to assess.


Questions about this policy: navarrogarisol@gmail.com