QalamRTL is committed to zero data collection and complete user privacy.

• ❌ No analytics — No tracking pixels, no telemetry, no usage statistics
• ❌ No user data — We never see, store, or transmit your conversations
• ❌ No network requests — Extension works 100% offline after installation
• ❌ No cookies — No localStorage, no sessionStorage, no IndexedDB for tracking
• ❌ No third-party services — No CDNs, no external APIs, no remote code

• ✅ Toggle state only — Whether the extension is enabled/disabled per tab
  • Stored locally using Chrome's storage.local API
  • Never leaves your device
  • Cleared when you uninstall the extension

{
  "permissions": ["storage"],
  "host_permissions": [
    
    "https://claude.ai/*"
  ]
}

Why do we need these?

1. storage — Save your toggle preference (enabled/disabled)
2. host_permissions — Apply CSS styling only on claude.ai
   • Extension cannot access any other websites
   • No access to your browsing history
   • No access to other tabs

┌─────────────────────────────────────────────┐
│  Your Browser (100% Local Processing)      │
├─────────────────────────────────────────────┤
│                                             │
│  1. You type Arabic text in Claude.ai │
│  2. QalamRTL detects Arabic characters     │
│  3. CSS class applied (.qrtl-block)        │
│  4. Text appears right-aligned             │
│                                             │
│  ❌ NO data sent to QalamRTL servers       │
│  ❌ NO data sent to third parties          │
│  ❌ NO data logged or stored               │
│                                             │
└─────────────────────────────────────────────┘

Your conversations remain 100% between you and the AI service (Anthropic).

QalamRTL follows secure coding practices:

• ✅ No eval() — No dynamic code execution
• ✅ No inline scripts — All JavaScript in separate files
• ✅ Content Security Policy — Strict CSP compliance
• ✅ Minimal DOM access — Only modifies text direction CSS
• ✅ No remote code — All code bundled in extension
• ✅ Open source — Fully auditable on GitHub

QalamRTL is 100% open source. You can audit every line:

# Clone and inspect
git clone https://github.com/yourusername/QalamRTL.git
cd QalamRTL

# Check for network requests (should find NONE)
grep -r "fetch\|XMLHttpRequest\|axios" src/
grep -r "https://" src/ | grep -v "claude.ai\|claude.ai"

# Check for data storage (should only find chrome.storage.local)
grep -r "localStorage\|sessionStorage\|IndexedDB" src/

# Check permissions
cat manifest.json | grep -A 10 "permissions"

QalamRTL uses:

• ❌ Zero dependencies — No npm packages, no libraries
• ✅ Vanilla JavaScript — Pure ES6, no frameworks
• ✅ Native Web APIs — MutationObserver, querySelector, classList

Total external dependencies: 0

QalamRTL runs in an isolated content script context:

• ✅ Cannot access page JavaScript variables
• ✅ Cannot intercept network requests
• ✅ Cannot read or modify cookies from AI services
• ✅ Cannot access password or form data

If you discover a security vulnerability:

1. Do NOT open a public GitHub issue
2. Email security concerns to: [[email protected]]
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will respond within 48 hours and provide a patch within 7 days for confirmed vulnerabilities.

• Manifest V3 — Using latest Chrome Extension security standards
• Regular audits — Codebase reviewed for security issues
• Dependency monitoring — N/A (zero dependencies)
• Prompt fixes — Security patches released immediately

For privacy or security questions:

• 📧 Email: [[email protected]]
• 🐛 Issues: GitHub Issues
• 📖 Docs: Privacy Policy

We take your privacy seriously. QalamRTL will never compromise your data.