Post-publication store comparison completed · August 6, 2026

Privacy should be
verifiable.

Review what SELFLEX can access, what the package audit found, and how to repeat the checks on your own device.

Review permissionsDownload audit record
REVIEWED VERSION1.4.2
API PERMISSIONS3 + 1 on Safari
SITE ACCESSAll HTTP(S)
EXTERNAL ANALYTICSNone
PERMISSIONS AND ACCESS

What can SELFLEX see?

The list below comes from the published v1.4.2 browser manifests. The Safari-only permission is identified separately.

BROAD SITE ACCESSHigh scope
http://*/*https://*/*

SELFLEX runs on HTTP and HTTPS pages to measure visible browsing time. Although <all_urls> is not written literally, these patterns provide equivalently broad website access.

PermissionWhy?Boundary
storage

Stores visits, durations, settings, and categories.

Extension-local browser storage
tabs

Reads active-tab URL, title, favicon, and tab lifecycle.

Open browser tabs
alarms

Runs local session maintenance.

Scheduled extension tasks
nativeMessaging

Transfers a local dashboard summary to the SELFLEX container app on Safari.

Safari only · SELFLEX container app
NOT REQUESTED

Additional browser areas outside SELFLEX

  • historyNo full history database access.
  • cookiesNo session-cookie access.
  • webRequestNo interception of page requests.
  • downloadsNo download access.
  • identityNo browser identity or OAuth.
  • bookmarksNo bookmark access.
  • notificationsNo system-notification access.
  • nativeMessagingNo messaging with external local applications.
TECHNICAL NOTE

“No browsing-data upload” is not the same as “zero network requests.”

SELFLEX does not upload browsing history to a SELFLEX server or analytics provider. The dashboard may request a favicon from a visited website’s own domain.

When SELFLEX Sync is enabled, the selected data groups leave the device. That transfer goes to the private iCloud database of the user’s own Apple account rather than to a SELFLEX server, and the payload is encrypted on the device. The full scope is defined in a separate document: SELFLEX Sync Data Processing Statement.

Accurate claim: SELFLEX has no remote user database, account system, telemetry, or analytics infrastructure.

POST-PUBLICATION VERIFICATION

The public store packages were compared.

Verified

  • The public Chrome 1.4.2 CRX and Firefox 1.4.2 XPI were downloaded on August 6, 2026.
  • The 28 shared application files in both stores have an identical content fingerprint.
  • Full package hashes are recorded in the downloadable audit file.

Important limitation

  • 27 of 28 application files match the local 1.4.2 archive.
  • background.js differs because the local archive includes Safari app synchronization added later. Exact reproducibility is therefore not claimed.