Fish Catcher privacy policy
Summary
Fish Catcher does its checks on your device. There is no account, no tracking, and nothing from the pages you visit is sent anywhere by default. A few optional features can look something up online, and each is off until you turn it on.

What stays on your device
By default, Fish Catcher runs entirely locally, using detection lists that ship inside the extension. It works with no internet connection.

The addresses of the pages you visit are analyzed on your device and never uploaded.
The page itself is read locally only to derive small facts (is there a password or code field, what brand does the page claim to be, where do its links and resources point). Page text and form values are never stored or transmitted.
QR codes you check are decoded on your device. For the right-click "Check this QR code" action the extension may take a screenshot of the visible tab to read the code when the image itself cannot be loaded; the screenshot stays in memory and is discarded.
Link and download checks happen in your browser.
Optional online features
These are off by default. When enabled, each does exactly one thing and nothing more.

Threat-list updates. Downloads a single Bloom-filter file from the Fish Catcher registry on GitHub, at most once a day and only when it has changed. The registry merges three keyless public feeds: Phishing.Database, URLhaus by abuse.ch, and OpenPhish. It only downloads, it never uploads, and every check against the list happens on your device. As with any web request, the host can see your IP address and that a file was requested.
Domain-age check (RDAP). Asks a public directory service how old a domain is. It sends only the domain name of the site being checked, and nothing else.
Google Safe Browsing. When you turn it on, Fish Catcher sends the address you visit to Google Safe Browsing, and it requires your own free Google API key.
Download guard. Local. Needs download and notification access so it can warn you about a disguised download. Nothing is uploaded.
Family mode. Local. Shows a larger, plainer alert and, if you add a helper's email address, offers a one-tap button that opens a pre-filled email in your own mail app. Nothing is sent until you press send. The helper address is stored only on your device.
Report this site opens a pre-filled GitHub issue in a new tab. Only the site's hostname is placed in the form, never the full address, and nothing is sent until you submit the issue yourself on GitHub.

You can leave all of these off and Fish Catcher still protects you with its local checks.

What is stored on your device
Fish Catcher stores a small amount of data in your browser's local extension storage:

Your settings (which optional features are on, your Safe Browsing key if you added one, your helper email if you added one).
Sites you mark as trusted.
If you turn on threat-list updates: the downloaded list itself, plus a cache tag and timestamp so it is fetched at most once a day and only when it has changed. Turning the feature off removes all of it.
This never leaves your device and is removed when you uninstall the extension.

Permissions
Fish Catcher asks for the minimum it needs. Network permissions for the optional features are requested only at the moment you turn a feature on.

Permission Why
storage Settings and trusted sites, on the device only
tabs Read the address of the tab you are viewing so it can be scored and the icon colored
activeTab On-demand actions on the current tab (right-click QR check, including the local screenshot fallback)
sidePanel (Chromium) The main interface is a side panel
contextMenus The right-click "Check this QR code" item on images
alarms The once-a-day threat-list refresh, only if that feature is on
Content script on http(s) pages Derives the small page facts described above, locally
Optional: downloads, notifications Download guard and the family-mode alert
Optional hosts: rdap.org, rdap.verisign.com Domain-age check
Optional host: raw.githubusercontent.com Threat-list download
Optional host: safebrowsing.googleapis.com Google Safe Browsing with your own key
What we never do
No analytics, no telemetry, no advertising, no third-party trackers.
No selling or sharing of any data.
No account and no profile.
No server of our own: there is nothing for your data to be sent to.
Because the extension is open source (MIT), you can verify all of this by reading the code.

Changes and contact
If this policy changes, the updated version is posted at https://fishcatcher.dev/privacy and in the source repository. Questions or concerns can be raised on the GitHub project.

Full version: https://fishcatcher.dev/privacy