🛡️ 1. Overview & Single Purpose
Rune Chat (and the Rune Notes Browser Extension) is a client-side companion for Rune — an open-source, zero-trust AI runtime and collaborative note-taking hub.
All AI interactions, document indexing, and storage operations occur solely between your browser and the Rune Notes server address that you enter yourself. The extension developer does not operate any centralized cloud service, proxy, or backend server.
🚫 2. Zero Developer Data Collection
The developer collects zero (0) data from users.
- No telemetry or analytics: There are no tracking scripts, analytics SDKs, error reporting beacons, or advertisement trackers.
- No third-party transmissions: No data is ever sent to the developer, Google, Mozilla, or any third party.
- Direct client-to-server connection: All network traffic consists solely of direct HTTP/WebSocket/SSE requests initiated from your browser directly to your self-hosted server URL.
- We guarantee: We do not sell, rent, trade, or monetize user data under any circumstances.
🔑 3. Permissions & Technical Justification
The extension declares only the minimal set of browser permissions strictly necessary to deliver its core functionality:
| Permission | Purpose & Scope |
|---|---|
storage |
|
activeTab |
Reads the title, URL, and user-selected text of the active tab only when you explicitly trigger a chat message or context menu action. It never monitors your browsing in the background and collects zero browsing history. |
sidePanel / sidebar_action |
Opens the side panel chat interface (Chrome Side Panel & Firefox Sidebar) where you interact with your notes and AI assistant. |
identity |
Executes standard OAuth 2.1 Authorization Code flow with PKCE (launchWebAuthFlow) against your self-hosted server. Authentication tokens stay strictly between your browser and your server.
|
scripting |
Used as an on-demand fallback to extract active page text when content scripts have not yet attached (e.g., tabs opened before extension installation). Runs only upon user submission. |
contextMenus |
Adds a "Send to Rune Chat" context menu item to start discussions from selected text on any webpage. |
| Host Permissions | Allows the extension to send API requests (SSE streams, note CRUD) to your configured Rune Notes server URL and inspect the foreground active tab on user action. |
💾 4. Data Storage & Security
- Local-First Storage: Credentials and configurations reside in your browser's protected extension sandbox.
- No Remote Code: All scripts, stylesheets, and vendored libraries (marked, highlight.js, KaTeX, Mermaid) are packaged locally within the extension bundle. No dynamic
eval(), remote script loading, or external CDN dependencies are used. - Token Lifetime: OAuth tokens are issued by your own server. Revoking access or logging out immediately deletes stored credentials.
🗑️ 5. User Control & Data Deletion
You maintain complete control over your data at all times:
- Logout: Clicking "Log Out" in the extension settings invokes
/oauth/revokeon your server and clears all local tokens fromstorage.local. - Extension Removal: Uninstalling the extension from your browser instantly and permanently erases all associated settings, server URLs, and cached tokens from your browser profile.
- Server-Side Data: Markdown notes stored on your Rune Notes server can be edited or deleted directly through the Rune Notes web interface or file system. Chat conversation logs are stored in your server's local SQLite database and can be managed or purged directly by the server administrator on the host file system.
📬 6. Open Source & Contact
Rune is 100% free and open-source software under the MIT License. You can audit every line of source code, verify build reproducibility, or report any privacy concerns:
- GitHub Repository: https://github.com/fourdollars/rune
- Issue Tracker: https://github.com/fourdollars/rune/issues
- Project Homepage: https://fourdollars.github.io/rune/