Blasphemy Bleep keeps no data about you and has no server. It sends something only when you send a problem report yourself.

Where it runs and what it reads
- It runs only on www.youtube.com, x.com (and twitter.com) and www.linkedin.com.
- YouTube: it reads the captions of the video you are watching, inside the page, to find the words to bleep or mute.
- X and LinkedIn: it reads the text of posts, comments and profile bios shown in the page and removes the matched words from what you see.
- Captions and post text stay in your browser. They are not stored or sent anywhere, except inside a problem report you send.

Your settings
Your settings (on or off, which words to bleep, beep or mute, your own word lists) are saved in your browser's built-in extension storage. If you are signed in to your browser with sync on, the browser syncs them between your own devices. The developer never sees them.

Problem reports
In the extension's settings, under "Something slipped through?", you can send a report. Nothing is sent until you press "Send report", and Firefox asks for your permission before the first one. A report contains:
- On YouTube: the video's link, the time you entered, and the caption text from about ten seconds around that time.
- On X or LinkedIn: the post's link, and the post's text before and after filtering.
- Always: your browser's name and version, the extension's version, your Blasphemy Bleep settings and word lists, and your note if you wrote one.

A report contains no name, account, email address or other identifier. It is sent to a Google Form and stored in the developer's Google Sheet. Google processes it for the developer, and Google's privacy policy applies to that step; Google may see your IP address as with any request to it. Reports are used only to fix the extension and are deleted once they are no longer needed for that.

The legal basis is your consent, given by sending the report (Art. 6(1)(a) GDPR). To have a report deleted, or to ask what a report contained, write to vs@mesoph.de with the post link or video and time it concerned.

What it does not do
No accounts, no analytics, no ads, no tracking, no selling or sharing of data. It loads no code from anywhere; everything it runs ships with the extension.

Contact
Vincent Schweiger, vincent.schweiger@predestined-slaves.org. Full details: https://bleep.predestined-projects.org/privacy

Notes to Reviewer:

No account is needed to test. Open any YouTube video with captions: a "Blasphemy Bleep" button appears under the video, next to Share, and its dot turns green once the captions are read. X and LinkedIn work on any page of those sites that shows posts.

The extension sends nothing unless the user sends a problem report from the popup. Before the first report, Firefox asks for the optional data collection the manifest declares (browsingActivity, websiteContent, technicalAndInteraction); without that OK nothing is sent. Reports go to a Google Form by a no-cors POST.

page.js runs in the page's main world on YouTube only, to read the caption request the player itself makes (that request carries a signed token a plain request lacks).

The code is not minified, bundled or generated, so no source package or build steps are needed.