Privacy policy
Fish Catcher works for you, not on you.
Summary
Fish Catcher does its checks on your device. There is no account, no tracking, and nothing from the pages you visit is sent anywhere by default. A few optional features can look something up online, and each is off until you turn it on.
What stays on your device
By default, Fish Catcher runs entirely locally, using detection lists that ship inside the extension. It works with no internet connection.
- The addresses of the pages you visit are analyzed on your device and never uploaded.
- QR codes you check are decoded on your device.
- Link and download checks happen in your browser.
Optional online features
These are off by default. When enabled, each does exactly one thing and nothing more.
Threat-list updates
Downloads a single Bloom-filter file once a day from the Fish Catcher registry, which merges three keyless public feeds: Phishing.Database, URLhaus by abuse.ch, and OpenPhish. It only downloads, it never uploads, and every check against the list happens on your device. As with any web request, the host can see your IP address and that a file was requested.
Domain-age check (RDAP)
Asks a public directory service how old a domain is. It sends only the domain name of the site being checked, and nothing else.
Google Safe Browsing
Off by default. When you turn it on, Fish Catcher sends the address you visit to Google Safe Browsing, and it requires your own free Google API key. Leave it off to keep every check on your device.
Download guard
Local. When enabled, it needs download and notification access so it can warn you about a disguised download. Nothing is uploaded.
You can leave all of these off and Fish Catcher still protects you with its local checks.
What is stored on your device
Fish Catcher stores a small amount of data in your browser's local storage, on your device only:
- Your settings (which features are on, your language choice).
- Sites you mark as trusted.
- A cache tag so updates only download when the list has changed.
This never leaves your device and is removed when you uninstall the extension.
Permissions
Fish Catcher asks for the minimum it needs. Network permissions for the optional features are requested only at the moment you turn a feature on.
- Current tab and pages, to read the address and page content of the tab you are on so it can check it.
- Local storage, for your settings and trusted sites.
- Downloads and notifications, requested only if you enable the download guard.
What we never do
- No analytics, no telemetry, no advertising, no third-party trackers.
- No selling or sharing of any data.
- No account and no profile.
Because the extension is open source, you can verify all of this by reading the code.
Changes and contact
If this policy changes, the updated version will be posted here and in the source repository. Questions or concerns can be raised on the GitHub project.