Privacy

net-identity does not include telemetry, analytics, or remotely loaded program code.

Optional encrypted vault

Enable Protect saved profiles to encrypt profiles, saved and applied proxy credentials, and the applied routing snapshot locally with a master password. AES-256-GCM and PBKDF2-HMAC-SHA-256 are implemented with native WebCrypto. The master password is never stored, logged, sent to a provider or included in a backup. The derived key is kept only in trusted extension memory/session storage. A full Firefox exit requires unlocking again; disabling or updating the extension may also clear the session key. Encrypted profiles and credentials remain durable. Unlock restores the applied snapshot, not newer saved-but-unapplied edits, and does not claim a fresh exit-IP observation.

Existing configurations are preserved on upgrade; encryption begins only after explicit setup. Export an encrypted backup outside the Firefox profile. Backups require the same master password, which cannot be reset. Restore is explicit and supported only into an empty installation; it resumes the route recorded in the backup. Uninstalling, clearing extension data or deleting the Firefox profile can remove local storage. Failed writes, wrong passwords and unsupported formats do not silently replace profiles with empty data or downgrade to unencrypted storage. Encryption does not protect an already-unlocked compromised browser or operating system, and migration is not a forensic secure erase of historical disk blocks.

What is stored before vault setup

After vault setup, the profiles, credentials and snapshots described below instead live inside persistent authenticated ciphertext. Language, the map automatic-loading boolean and vault on/off metadata remain unencrypted; no map browsing history is stored.

• Profiles and non-secret applied route: name, proxy host, authentication-required flag, location, timezone and WebRTC choice are kept in Firefox extension storage (storage.local) until you delete the profile or extension.
• Proxy username and password: kept in Firefox session storage until Firefox exits.
• Active routing snapshot: includes credentials needed after the background page restarts; kept in Firefox session storage until Firefox exits.

Before vault setup, neither a username nor a password is written into the saved or applied profile. Schema 4 converts legacy usernames to a non-secret authentication-required flag. Migration removes secret keys from supported documents that can be migrated safely. Newer or unsafe documents are left unchanged and held inactive, rather than silently dropping a profile or its proxy.

What leaves this computer

Location lookup. Activating or refreshing a profile can ask https://ipwho.is/ where the current connection appears to come from. The request sends no cookies, no referrer, and no explicit proxy credentials. A proxied profile shows that service the proxy's public address. Browser routing shows it your own public address, and only after you allow that collection in Firefox. Installing the extension does not create a profile, so a fresh install makes no such request. Coordinates from this lookup are approximate (about 20 km) and are not presented as GPS.

Automatic draft preview. Entering or editing a valid proxy endpoint in the open setup editor automatically contacts https://ipwho.is/ through that entered proxy after a short pause, before Save or enable. The check previews public IP, approximate location and timezone. Only this marked extension request uses the draft; existing ordinary-page routing stays unchanged. Required Firefox consent still applies. The request omits cookies/referrers, refuses redirects, never falls back to Direct and has bounded lifetime/body size. Credentials go only to the entered proxy, not the location provider. A check saves no profile or credentials. Editing or closing the editor cancels the old check; there is no automatic retry loop. Options with Public IP / GeoIP set to Disabled do not schedule checks; popup quick setup previews by design.

Location picker. The picker initially uses a local coordinate grid and makes no map request. Choosing Load online map explicitly enables it and remembers automatic loading for subsequent visible map openings. Unload or unchecking automatic loading clears that preference and stops the current map. Each opening creates a fresh route-generation-bound session and rechecks credentials and consent; automatic opening cannot prompt for new permission. The remembered preference is not a saved network authorization. MapLibre program code, CSS and its worker ship with the extension. Only map data comes from https://tiles.openfreemap.org: styles, tile metadata, vector/raster tiles, sprites and font glyphs are requested as needed. Panning and zooming can fetch additional data. This is separate from GeoIP lookup; disabling GeoIP does not cancel an explicitly enabled online map.

OpenFreeMap and its delivery infrastructure, which may include Cloudflare, can see your network-visible IP, the viewed map region encoded in tile coordinates, and normal HTTP metadata. No separate profile or marker upload occurs, and proxy credentials are not sent to the map provider; the viewed region is nevertheless not private from that provider. Requests omit cookies, origin credentials and referrers, reject redirects and stay within the approved provider URL policy. No device-location API, geocoder, API key or account is used. The extension does not spoof a Referer or web origin.

Map requests use the currently applied route, not unsaved proxy edits. An active proxy remains authoritative; failure does not trigger Direct. Provider-host bypass rules refuse online-map loading rather than silently overriding a bypass. Under Direct or Off, optional personal-data permission is required before loading, and Firefox/system proxy settings may still affect the visible IP. Route changes, permission revocation or closing the editor invalidate the map session. Unload the map to stop further map requests. Typed coordinates and the local grid remain usable when the map is disabled, unavailable or cannot render with WebGL.

OpenFreeMap's privacy policy states that ordinary logs exclude IP addresses, anonymized service metadata may be retained indefinitely, and security-incident IP logs may be kept for up to 30 days. Cloudflare may process requests under its own policy. See the provider's terms. The extension makes no claim that the provider collects nothing.

Proxy traffic. Traffic you choose to send through a proxy goes to that proxy. The extension does not add its own analytics to that traffic. If a selected proxy fails, ordinary external traffic fails rather than switching to Firefox's direct or system route. The selected profile stays selected and can recover without a route switch. Without an enabled vault, after a full Firefox exit, session-only usernames and passwords are lost; if the applied profile requires authentication, non-bypassed ordinary webpage and extension-observable GeoIP requests are blocked until you save replacement credentials and enable the profile. The request gate prevents those ordinary requests from trying that endpoint anonymously, even if the proxy would accept it: anonymous access could produce a different egress identity. Profiles intentionally configured without authentication and explicit bypasses keep their existing behavior.

Proxy transport security. Local storage encryption does not encrypt the connection to a proxy. SOCKS5 username/password authentication is plaintext on that connection (RFC 1929); HTTP proxy Basic authentication likewise needs a protected transport. HTTPS to a destination does not by itself encrypt the preceding SOCKS authentication. Use only a trusted proxy and a suitably protected network path. This extension does not add an encrypted tunnel.

HTTP/HTTPS proxy account identity. The proxy server must enforce authentication. Saving or applying credentials alone does not prove which account handled a request. An HTTP/HTTPS endpoint that accepts anonymous CONNECT without a proxy-authentication challenge (407) can carry ordinary webpage or map requests anonymously. If a specific account must be used, configure the proxy to reject anonymous access and verify the effective account at the proxy. This limitation is separate from the protected Firefox browser-service requests described below.

What pages can see

Pages receive the location and timezone of the active profile through compatibility shims. Those shims are visible to a page that inspects them. They are not a claim that the browser is anonymous or undetectable. A frame Firefox will not inject into can still see the computer's timezone and location.

Your choices

• A fresh install makes no GeoIP lookup. Avoid entering a valid endpoint in quick setup to avoid its automatic preview; in Options, set Public IP / GeoIP to Disabled before editing to suppress draft checks and runtime lookups.
• Leave the online map and its automatic-loading preference disabled to avoid OpenFreeMap requests. Unload it or close the editor to stop its session without changing the active identity.
• Use a proxy profile when the location lookup should see the proxy's address.
• Use Custom identity policies for manual coordinates, a timezone override, unavailable geolocation, or disabled GeoIP lookup. Disabled GeoIP makes no GeoIP provider request; separately enabled online-map requests are independent.
• Direct switches routing immediately even without optional consent. It keeps native geolocation blocked until Off; identity is unavailable until a permitted lookup succeeds.
• Save stores edits without activation. Save and enable saves the visible form and activates it. Selecting an existing route activates its saved configuration. An event-page restart preserves the applied revision and credentials, including when a newer revision was saved. Leaving both username and password blank keeps existing stored credentials; entering either replaces the pair, and Clear credentials removes the saved credentials (enabling the updated profile also removes them from runtime).
• Deactivate the profile to stop the shims and release the WebRTC setting.

Passive health observations

The background temporarily correlates at most 512 request IDs with the selected SOCKS or HTTP(S) endpoint, route generation and destination hostname. It keeps no URL path/query, headers or event-provided credentials. Samples expire after 30 seconds, failure evidence uses a five-second window, and everything is in memory, not durable storage or telemetry. These observations can indicate suspected trouble but cannot identify its transport cause. No diagnostic probe or automatic HTTP retry is sent. Credentials you supply are transmitted only to your selected proxy for authentication, never to the GeoIP provider or page scripts.

Firefox consent

Required locationInfo describes approximate egress location lookup and the viewed map area requested from OpenFreeMap. Required authenticationInfo describes the existing credentials sent to your chosen proxy. Optional personallyIdentifyingInfo gates Direct/Off online-map loading and direct GeoIP requests that can expose your own public IP. OpenFreeMap is a recipient when you explicitly enable the online map or reopen it with the remembered automatic-loading preference. The earlier authentication declaration disclosed an existing proxy-authentication recipient; it did not itself add a new recipient or telemetry. Firefox may show changed required-data consent on installation or update. These built-in controls require desktop Firefox 140 or later. Mozilla's data taxonomy explains the categories.

Protected Firefox requests

Firefox does not let extensions cancel every browser-service request. In Firefox 158, protected Remote Settings traffic could still reach the same selected proxy anonymously when the session credential pair was missing. This is not a switch to Direct, but a proxy that accepts anonymous clients may assign a different egress identity. Ordinary permitted webpage traffic and observable GeoIP requests remain covered by the missing-credential gate. For account identity across all browser traffic, configure the proxy server to reject anonymous access. The extension is not a browser-wide kill switch and does not change OS firewalls or Firefox security settings.