Privacy policy
Fish Catcher works for you, not on you.
Summary
Fish Catcher does its checks on your device, with detection lists that ship inside the extension, and works with no internet connection. No account, no tracking, and nothing from the pages you visit is sent anywhere by default. A few optional features look things up online; each is off until you turn it on.
What stays on your device
- Page addresses are checked on your device, never uploaded.
- The page is read locally only for small facts: a password or code field, the brand it claims to be, where its links point. Page text and what you type are never stored or sent.
- QR codes are decoded on your device. If the right-click check cannot load the image, it may take a one-off screenshot of the visible tab to read the code; that stays in memory and is discarded.
- Link and download checks happen in your browser.
Optional online features
Threat-list updates
Downloads one Bloom-filter file a day from the Fish Catcher registry, which merges three keyless public feeds: Phishing.Database, URLhaus by abuse.ch, and OpenPhish. Download only; every check against the list happens on your device. Like any web request, the host sees your IP address and that a file was requested.
Domain-age check (RDAP)
Asks a public directory service how old a domain is. Sends only the domain name.
Google Safe Browsing
Sends the address you visit to Google and needs your own free Google API key.
Download guard
Local. Needs download and notification access to warn you about a disguised download. Nothing is uploaded.
Family mode
Local. A larger, plainer alert and, if you add a helper's email, a one-tap button that opens a pre-filled email in your own mail app. Nothing is sent until you press send; the helper address stays on your device.
Report this site opens a pre-filled GitHub issue in a new tab with only the site's hostname, never the full address. Nothing is sent until you submit it yourself.
What is stored on your device
In your browser's local storage:
- Your settings, including a Safe Browsing key or helper email if you added one.
- Sites you mark as trusted.
- With threat-list updates on: the downloaded list plus a cache tag and timestamp, so it is fetched at most once a day and only when changed. Turning the feature off removes it all.
It never leaves your device and is removed when you uninstall.
Permissions
Network permissions are requested only when you turn a feature on.
- Current tab and pages, to read the address and content of the tab you are on, including the right-click QR check.
- Local storage, for your settings and trusted sites.
- Downloads and notifications, only if you enable the download guard or family mode.
- Specific websites (registry, RDAP directory, Google Safe Browsing), each only when you turn on that feature.
What we never do
- No analytics, telemetry, advertising, or third-party trackers.
- No selling or sharing of any data.
- No account and no profile.
It is open source; verify all of this in the code.
Changes and contact
Changes are posted here and in the source repository. Questions go to the GitHub project.