Bulkhead collects nothing. There is no account, no analytics, no telemetry,
and nothing is ever sent to the developer.

Everything it stores stays in your own Firefox profile, using the browser's
extension storage: which container uses which server, your favourites and
recent picks, and any custom servers you add. None of it leaves your
computer, and it goes away when you uninstall the add-on.

Three kinds of request leave your browser because of Bulkhead:

• To check that a container's server is working, it requests
  https://am.i.mullvad.net/json through that container's own server, roughly
  every ten minutes while things are healthy and more often while they are
  not. The request carries no cookies and nothing identifying. It travels
  through the server being tested rather than over your ordinary connection.
• To show you the list of Mullvad servers, it fetches that list from Mullvad's public API about once a day, and sooner if one of your servers fails. The request carries no cookies and nothing identifying, routed through "No container" setting.
• To show you Mullvad’s status messages about its servers, it fetches https://mullvad.net/en/__data.json with each list refresh, and once a session when you open settings. The request carries no cookies and nothing identifying, routed through "No container" setting.

All of those addresses belong to Mullvad VPN AB, who are not affiliated with this add-on and have their own privacy policy covering what they can see:
https://mullvad.net/help/privacy-policy/

If you add your own SOCKS5 server, any username and password you enter are stored in your Firefox profile as ordinary settings, unencrypted. They are sent only to that server, in the clear, because SOCKS5 offers nothing better.

Questions: https://github.com/S4N-T0S/Bulkhead/issues