TI Console does not collect, store remotely, or transmit any data about
you or about your work.

WHAT STAYS IN THE BROWSER

All of it. The text you paste, the indicators found, the case, notes,
verdicts, timeline and settings are kept in your browser profile
(browser.storage.local) and are available only to you. Resetting the
profile or removing the extension destroys that data irreversibly.

The extension has no server of its own, no accounts, no synchronisation
between users and no usage statistics. It declares
data_collection_permissions: {"required": ["none"]} in its manifest.

WHAT NETWORK REQUESTS THE EXTENSION MAKES

Exactly three kinds, and all three happen on your explicit action:

1. Opening an analysis service you selected, in a new tab. This is an
   ordinary browser navigation: the service sees what it would see if you
   had typed its address yourself.
2. "Pull text from link" — fetching a page at an address you typed in.
   The request comes from your address, and the infrastructure you are
   investigating sees it. The interface states this next to the input
   field.
3. Downloading the LOLBAS or GTFOBins reference when you press "Load".
   One static file is fetched from the rights holder's site. The request
   contains nothing from your work — no indicator, no page address, no
   case — only the name of the reference file. It happens once;
   afterwards the reference lives in your browser profile and is read
   from disk. "Forget" deletes it and revokes the host permission.

Nothing else is sent: not indicators, not page contents, not the context
of your investigation — neither automatically nor on a button.

PERMISSIONS

Access to websites (<all_urls>) is not requested at install time. It is
requested at the moment you press "Parse page" or "Pull text from link",
and you may refuse. Permission for the three reference hosts
(lolbas-project.github.io, gtfobins.github.io, gtfobins.org) is requested
separately, when you press "Load", and is revoked by "Forget".

THIRD-PARTY SERVICES

The extension contains a list of public analysis services and opens them
at your choice. What those services do with your query is governed by
their own policies; the extension passes them nothing beyond what you
opened yourself.

If your organisation distributes a list of own and client address ranges
through browser policy, values inside those ranges are flagged in the
results and are never sent to public services: bulk open skips them, a
playbook skips them, and opening a single one asks for explicit
confirmation. The list itself is never transmitted: it is read from
browser policy and used only for comparison on your machine.

CHANGES

Changes to this policy are published together with a change of the
extension version.