Arca by DangerCat

Arca is a personal image-organization tool I built for my own use.
It saves images into a self-hosted backend service I run on my own
hardware.

Heads up: this extension is not currently useful to anyone but me.
The backend service it talks to is private — I haven't released it
yet and may never, or may open-source it later once it's ready. If
you install this extension today, every save attempt will show
"Backend offline" and nothing will happen. No data will be
transmitted anywhere.

The reason it's published publicly on AMO rather than unlisted is
so Firefox Sync auto-installs it across my own Firefox instances
(laptop + desktop + work machine) without manual drag-and-drop each
time I update. Unlisted add-ons don't sync.

What it does when the backend IS running:

• Right-click any image → "Keep in Arca" opens a small board-picker
  popup with keyboard shortcuts for quick saving.
• Optional auto-save: liking or bookmarking a post on X/Twitter, or
  saving a pin on Pinterest, sends that post's still images to the
  backend's unsorted queue for filing later. This is OFF by default
  and is turned on per-site in the extension popup. Videos, GIFs,
  avatars and quoted posts are skipped.
• Upgrades the image URL to the highest-quality variant on Twitter
  (?name=orig), Pinterest (largest srcset candidate), and Tumblr
  (_1280) before fetching.
• Offline queue in browser.storage.local drains when the backend
  is reachable again.
• Optional shared-secret API key authenticates saves against the
  user's own backend; key is stored in browser.storage.sync to ride
  Firefox Sync between devices.

Permissions explained:

• *://*/* — needed so fetch() can download image bytes from any
  CDN with the user's logged-in cookies applied; many image hosts
  refuse hotlinked requests. fetch() is only ever called with (a) an
  image URL, and (b) the user's own configured backend URL.
• Content scripts on x.com / twitter.com and pinterest.com
  (plus the .co.uk and .ca Pinterest domains) — these power the
  optional auto-save feature. When you like or bookmark a post on X,
  or save a pin on Pinterest, the content script reads the image URLs
  out of that one post's DOM and hands them to the extension's
  background script, which downloads the images to your own backend.
  The scripts read only the post you acted on. They do not read your
  timeline, your feed, your direct messages, or your account details.
  They inject nothing into the page, modify no page behaviour, and do
  not run in iframes. Auto-save is off by default.
• webRequest — observes (never blocks or modifies) the site's own
  save/like API call, so auto-save only fires once the action has
  actually succeeded server-side rather than on an optimistic click.
• storage — caches the board list, persists the queue of pending
  saves, and stores the backend URL + optional API key.
• contextMenus — adds the "Keep in Arca" right-click item.
• alarms — periodic board refresh and queue flush.
• notifications — toast on manual save/failure. Auto-saves are
  silent.

No telemetry, no analytics, no third-party services, no developer-
controlled server. Image bytes only travel between the source CDN
and the user's own backend.