Privacy disclosure builder

For plugins listed with FPP - Falcon Player.

Builds the privacy block for your plugin's pluginInfo.json, one question at a time. FPP turns this block into the six privacy lights and the install dialog; the listing check compares it with your code. Write it for a neighbour, not a developer. Nothing you type leaves your browser. The block is described in PLUGININFO_FORMAT.md; what a listing needs is in the plugin guidelines.

    Start from your repo

    Your existing pluginInfo.json pre-fills what it can - the plugin name and, if you already have one, the privacy block to edit. You can also start blank.

    Or paste your pluginInfo.json

    Summary

    One or two plain sentences for the install dialog: what leaves the device, to whom, and why. This is the first thing a person deciding whether to install your plugin reads.

    If the plugin does nothing off this device and keeps nothing about anyone, "Runs on this device only." is enough. Tip: fill in the other steps first, then come back and write the summary from what you declared.

    Sends data

    Every place data leaves this device: the plugin's own connections, anything it publishes on FPP's MQTT, fetches through FPP's helpers, loads into the operator's browser from a plugin page (a CDN, fonts, an embed), or broadcasts (FM, LoRa). Empty means the plugin sends nothing.

    A CDN, font or badge host your pages load is a destination only if the load actually happens. FPP serves plugin pages under its own Content-Security-Policy, so such a tag is blocked unless your install script whitelists the host with ManageApacheContentPolicy.sh add <directive> <host> or the page is served by your own listener (Remote access other than none). If it is, declare it with What is sent your browser's address - FPP shows that as amber "Your browser loads files from <host>"; if not, bundle the file or remove the tag.

    Do not list GitHub (github.com, api.github.com, raw.githubusercontent.com, *.github.io) for fetching your own code, releases, update checks or a package - FPP's plugin manager makes that traffic already. A program you download is a System change of kind download instead.

    Nothing listed = "No sending disclosed" (green).

    None of the choices fit? To is free text, so any destination can be named: a hostname, a phrase for something the operator enters, or a broadcast. If a send really cannot be described that way, describe it in the Anything else step so it still shows in the install dialog, and open an fpp-data issue so the vocabulary can grow. Never invent a new key or value - FPP ignores it and the listing check rejects it.

    Collects data

    Data the plugin keeps on this device about people, beyond the operator's own settings: logs of who did what, messages, names, photos, addresses. Empty means it keeps only the operator's settings.

    Nothing listed = "No collection disclosed" (green). Data about anyone but the operator or their household (visitors, passers-by, third parties, performers) with no time limit is red ("Collects visitor data"); give it a time limit and it is amber ("Collects, with limits").

    None of the choices fit? Pick the closest one and describe the real behaviour in What is kept - About whom only sets the colour. If nothing is close, leave it out here, describe it in the Anything else step so it still shows in the install dialog, and open an fpp-data issue so the vocabulary can grow. Never invent a new key or value - FPP ignores it and the listing check rejects it.

    Camera & mic

    Sensors the plugin reads that can observe a person. Empty means none. A camera stream that leaves the device is also a Sends data entry.

    Nothing listed = "No camera or mic disclosed" (green). A camera or microphone that isn't stored is amber ("Camera, not stored"), as is any other sensor ("Uses a sensor, not stored", or "Sensor readings kept" if its readings are stored); stored camera or microphone data, or face/body tracking, is red ("Records people").

    None of the choices fit? Pick the closest one and describe the real behaviour and use Anything else for the detail (sensors have no free-text line). If nothing is close, leave it out here, describe it in the Anything else step so it still shows in the install dialog, and open an fpp-data issue so the vocabulary can grow. Never invent a new key or value - FPP ignores it and the listing check rejects it.

    Remote access

    The plugin's own listener, at its widest reach. Pages and API routes served through FPP's normal web server are none.

    None of the choices fit? Pick the widest reach that applies and explain the detail in Anything else. If nothing is close, leave it out here, describe it in the Anything else step so it still shows in the install dialog, and open an fpp-data issue so the vocabulary can grow. Never invent a new key or value - FPP ignores it and the listing check rejects it.

    System changes

    Every change outside the plugin's own directory: services it installs, ports it opens, FPP settings it writes, software it downloads, package sources it adds, credentials it reads, privileges it grants. Empty means nothing outside its own directory.

    Nothing listed = "No system changes disclosed" (green). Any change is amber ("Changes this device"); package-source and tunnel are red ("Changes this device permanently"), as are reads-core-credentials ("Reads FPP's credentials") and privilege ("Grants extra privileges").

    None of the choices fit? Pick the closest one and describe the real behaviour in the What line - the colour comes from the kind, the words come from you. If nothing is close, leave it out here, describe it in the Anything else step so it still shows in the install dialog, and open an fpp-data issue so the vocabulary can grow. Never invent a new key or value - FPP ignores it and the listing check rejects it.

    Can it be checked?

    Can everything that runs be read by anyone: is it in your repository, from a public package source (apt, pip, npm, CPAN or similar) whose source is published, or an open-source project's own release of its public code? A closed binary wheel or vendor SDK from PyPI/npm is closed code; a fetched package is still a System change of kind download.

    Anything else

    Anything the other keys cannot say: what is left behind after uninstall, a visitor-facing page hosted by a vendor, payments taken, a self-updating component, a behaviour none of the earlier choices fit. FPP shows this text verbatim in the install dialog, so it is never lost - it just doesn't change a light's colour. It counts like the other keys on upgrade: a change to it re-shows the dialog before the update is applied (rewording the summary alone does not). Write none if there is nothing.

    If you had to put something here because the vocabulary has no place for it, please open an fpp-data issue saying what it was. The keys and values are fixed on purpose (FPP computes the colours from them and the listing check matches your code against them), so the way to cover a new kind of behaviour is to add it to the vocabulary for everyone, not to invent a key in one plugin.

    Your privacy block

    Paste this into your pluginInfo.json as the "privacy" key, or copy the whole file with it merged in. Then run it past the plugin preview once it's pushed.

    How FPP will show it

    Install
    
      
      
    
      
    This block is what you declare. The fpp-data listing check greps your code against it - a send, sensor, service or credential read it finds that you didn't declare is a blocker (privacy-undeclared-*), so say what the plugin actually does. A plugin without this block cannot be listed or updated.