Align extension privacy and security information

hudra/index.html

@@ -372,6 +372,7 @@
           <a href="#how-it-works">How it works</a>
           <a href="https://chromewebstore.google.com/detail/hudra/bjggdeecklhnpebgmjiaedaadmpdoddm">Chrome Web Store</a>
           <a href="https://microsoftedge.microsoft.com/addons/detail/hudra/aogdgaofdldbpmkjknklojbhcbcfandb">Microsoft Edge Add-ons</a>
+          <a href="https://git.napper.au/napper/hudra">Source code</a>
         </div>
         <div>
           <strong>Support</strong>

hudra/privacy/index.html

@@ -19,7 +19,7 @@
 <section id="summary"><h2>1. Summary</h2><p>Hudra is a browser extension for presenting supported structured QLearn and Canvas lesson pages. To provide that feature, it processes website content and page information visible in the supported tab. Hudra does not require a Hudra account.</p></section>
 <section id="data"><h2>2. Information Hudra may access</h2><table class="data-table"><caption class="sr-only">Information Hudra may access and why it is used</caption><thead><tr><th>Information</th><th>Purpose</th></tr></thead><tbody><tr><td>Visible lesson content and page structure</td><td>To divide the lesson into slides and display it in presenter and audience views.</td></tr><tr><td>Page address and site context</td><td>To recognise supported QLearn and Canvas lesson pages at <code>https://*.qlearn.eq.edu.au/*</code> and <code>https://*.instructure.com/*</code>, and activate Hudra only where appropriate.</td></tr><tr><td>Active presentation metadata</td><td>To manage an active presentation, including its mode and associated tab and window identifiers.</td></tr></tbody></table><p>Because QLearn and Canvas pages can contain user-generated or student-related material, the page content Hudra processes may include personal information placed there by an authorised user. Hudra does not need that information for any purpose other than displaying the requested presentation.</p><p>Hudra does not seek access to passwords, payment information, authentication cookies, private messages or unrelated browsing history.</p></section>
 <section id="use"><h2>3. How information is used</h2><p>Information accessed by Hudra is used only to provide its disclosed presentation purpose, including recognising supported pages, generating slides, operating presenter controls and arranging presenter and audience windows.</p></section>
-<section id="storage"><h2>4. Storage, retention and transmission</h2><p>Hudra processes lesson content locally in the browser. It does not send lesson-page content to Napper.au or introduce a separate telemetry, analytics or content-upload service. Lesson pages and their embedded resources continue to be loaded from their existing providers by the browser.</p><p>Hudra temporarily stores active presentation metadata in Chrome's session-scoped extension storage. This includes presentation mode and tab and window identifiers needed to manage and restore an active presentation. Lesson content and user preferences are not stored. Chrome clears this session data when the extension is disabled, reloaded or updated, or when the browser restarts.</p><p>Email sent voluntarily to support@napper.au is transmitted through the sender's and recipient's email services and retained only as reasonably needed to respond, troubleshoot, maintain security or meet legal obligations. Do not include student records, passwords or private course content in support messages.</p></section>
+<section id="storage"><h2>4. Storage, retention and transmission</h2><p>Hudra processes lesson content and generated slide previews temporarily in browser memory during an active presentation. Lesson content and previews are not written to extension storage or transmitted to Napper.au. Lesson pages and their embedded resources continue to be loaded from their existing providers by the browser.</p><p>Hudra temporarily stores active presentation metadata in Chrome's session-scoped extension storage. This includes presentation mode and tab and window identifiers needed to manage and restore an active presentation. Lesson content, generated previews and user preferences are not stored there. Chrome clears this session data when the extension is disabled, reloaded or updated, or when the browser restarts.</p><p>Hudra contains no separate telemetry, analytics or content-upload service. Email sent voluntarily to support@napper.au is transmitted through the sender's and recipient's email services and retained only as reasonably needed to respond, troubleshoot, maintain security or meet legal obligations. Do not include student records, passwords or private course content in support messages.</p></section>
 <section id="sharing"><h2>5. Sharing and sale of data</h2><p>Hudra does not sell user data. Hudra does not share lesson content with advertisers, data brokers or unrelated third parties. Information voluntarily included in a support request may be processed by the email and hosting providers needed to deliver and respond to that request, or disclosed where required by law.</p></section>
 <section id="limited-use"><h2>6. Chrome Web Store Limited Use</h2><p>Hudra's use of information received from Chrome APIs will comply with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data received from Chrome APIs is used only as necessary to provide Hudra's single, user-facing classroom presentation purpose.</p></section>
 <section id="website"><h2>7. Hudra website</h2><p>The public Hudra website may receive ordinary server information needed to deliver a web page, such as an IP address, browser type, requested page and request time. This information may be present in short-term security or server logs. The website does not use that information to inspect QLearn or Canvas lesson content.</p></section>

hudra/support/index.html

@@ -39,7 +39,7 @@
 
         <section id="report"><h2>4. Report a problem</h2><p>A useful bug report includes the Hudra version, browser name and version, page type, steps to reproduce the issue, and what you expected to happen. Screenshots are helpful, but remove student names, personal information and private course content first.</p><p><a class="button button-primary" href="mailto:support@napper.au?subject=Hudra%20bug%20report&amp;body=Hudra%20version%3A%0ABrowser%20and%20version%3A%0AQLearn%20page%20type%3A%0ASteps%20to%20reproduce%3A%0AExpected%20result%3A%0AActual%20result%3A">Create a bug report email</a></p></section>
 
-        <section id="permissions"><h2>5. Why Hudra needs browser permissions</h2><p>Hudra requests only the access needed to provide its presentation features:</p><ul><li><code>activeTab</code> accesses the supported lesson page you select when you start Hudra.</li><li><code>scripting</code> reads the visible lesson structure and builds the local presentation interface.</li><li><code>storage</code> retains temporary session metadata needed to manage and restore an active presentation.</li><li><code>system.display</code> detects usable displays and arranges presenter and audience windows.</li><li>Host access allows Hudra to operate on supported QLearn and Instructure-hosted Canvas lesson pages.</li></ul><p>See the <a class="text-link" href="/hudra/privacy">privacy policy <span>→</span></a> for further information.</p></section>
+        <section id="permissions"><h2>5. Why Hudra needs browser permissions</h2><p>Hudra requests only the access needed to provide its presentation features:</p><ul><li><code>activeTab</code> provides temporary access after you click Hudra or use its shortcut. Hudra uses it to inspect the selected tab and show an explanatory notice when a page is unsupported.</li><li><code>scripting</code> injects Hudra's packaged page-detection and presentation code into the selected lesson page. No remote code is downloaded or executed.</li><li><code>storage</code> retains only temporary session metadata needed to coordinate and restore an active presentation. Lesson content and generated previews are not written to extension storage.</li><li><code>system.display</code> detects usable displays and arranges presenter and audience windows.</li><li>Host access allows Hudra to operate on supported QLearn and Instructure-hosted Canvas lesson pages. It is required for the new audience tab created in dual-screen mode because the original tab's temporary <code>activeTab</code> grant does not transfer to that tab.</li></ul><p>Hudra activates only after you click its toolbar button or use its keyboard shortcut. See the <a class="text-link" href="/hudra/privacy">privacy policy <span>→</span></a> for further information.</p></section>
 
         <section id="remove"><h2>6. Disable or uninstall Hudra</h2><ol><li>Open your browser's extensions page.</li><li>Find Hudra.</li><li>Turn it off to disable it temporarily, or choose <strong>Remove</strong> to uninstall it.</li></ol><p>Removing Hudra also removes its locally stored extension data according to your browser's behaviour.</p></section>