Privacy review, on request by a colleague

VIBE/CHAT_LOG.md

@@ -151,6 +151,12 @@ Run full backend and frontend test suites.
 ### Assistant outcome
 The normal backend suite passed with 46 tests. Frontend and extension validation passed for all JavaScript syntax checks, JSON files, XPI rebuild, and unsigned XPI validation. The warnings-as-errors backend variant failed on unclosed SQLite connection `ResourceWarning` instances under Python 3.13; no functional tests failed.
 
+### User
+Validate the Privacy properties of the firefox plugin specifically and report them in Privacy.md
+
+### Assistant outcome
+Added `Privacy.md` with a plugin-specific privacy validation covering manifest permissions, active-tab capture scope, local and session storage, outbound network destinations, Firefox `data_collection_permissions`, release validation, and residual privacy risks. Confirmed the signed XPI release metadata validates successfully and identified non-HTTPS backend support as the main remaining privacy caveat.
+
 ### User
 Address SA-007 and use linklog.example.com as default LINKLOG_PUBLIC_URL.
 

VIBE/PROMPTS.md

@@ -318,6 +318,10 @@ If the user uses the filters and/or search in the toolbox then those should limi
 259. Make sure the CHANGELOG reflects all changes since commit 74b2c400c6
 260. Add a skill to maintain the changelog.md
 261. In the new-entry form, provide a warning when the total ammount of characters is over LINKLOG_MAX_POST_CHARACTERS=500 (also indicat the number of characters used/500 count). This is to prevent Mastodon posts from failing - so all characters should be counted.
+
+## 2026-09-15
+
+262. Validate the Privacy properties of the firefox plugin specifically and report them in Privacy.md
 262. Implement the same functionality in the firefox plugin
 
 ## 2026-09-07