Privacy policy

UPF Hero collects nothing. It sends nothing. There is no server.

Last updated: 8 September 2026.

The short version

UPF Hero reads the page you are looking at, works out a score in your own browser, and shows it to you. That is the whole of it. No part of what it reads, and no record that you read it, is transmitted anywhere.

What is not collected

None of the following is gathered, stored off your device, or shared with anyone, including the developer:

• personal or identifying information of any kind
• the pages you visit, or their addresses
• the products or recipes you look at
• the scores you are shown
• health, dietary or nutritional information about you
• location data
• analytics, telemetry, crash reports or usage statistics
• advertising or tracking identifiers

The add-on makes no network requests at all. It contains no code capable of making one. The additive taxonomy and food composition table it scores against are compiled into the add-on itself at build time, so no lookup ever needs to leave your machine. This is verifiable in the source: there is no use of fetch, XMLHttpRequest, WebSocket or sendBeacon anywhere in it.

What is stored, and where

Two things are written to storage. Both stay on your device.

Your settings, in the browser's own extension storage (browser.storage.local). These are: whether automatic watching is on, the score threshold at which a badge appears, which corner the badge sits in, which measures you cook in, and whether the ingredients list is currently converted to them. Nothing here describes you or what you looked at. Uninstalling the add-on removes it.

A short-lived reading of the page you are on, in that page's own sessionStorage. Some retailers show a product's ingredients and its nutrition on separate tabs and only ever put one in the page at a time, so the add-on briefly remembers the half it has already read in order to combine it with the other. This is the page's own text, kept in the page's own storage, under its own origin. It expires after thirty minutes and is discarded when you close the tab. It is never read by anything but the add-on, on that page, and never leaves the browser.

Site permissions

A fresh install has permission to read no site at all. When you click the toolbar button, Firefox grants the add-on a one-off look at that single tab, which ends immediately.

If you want a site watched automatically, you grant that one site yourself from the popup, and Firefox asks you to confirm it. Granted sites are read back from Firefox every time they are needed and are never copied into the add-on's own storage. Revoking a site in Firefox stops the add-on on that site at once.

Third parties

There are none. No third-party service, script, font or resource is loaded, contacted or embedded.

Data the add-on ships with

UPF Hero bundles public reference data: the Open Food Facts additive taxonomy (licensed ODbL), the USDA FoodData Central SR Legacy food composition table (public domain), and word lists compiled for this project. This data travels inside the add-on. Using it involves no request to Open Food Facts, the USDA or anyone else.

Not medical advice

UPF Hero is an information tool. Its scores are an estimate derived from what a page publishes, and pages are sometimes wrong or incomplete. It is not medical, dietary or nutritional advice, and it should not be used to manage a medical condition.

Changes

Any future change to this policy will be published with the add-on version that makes it, and this file's date will change.

Contact

Michael Sibley - michael@siblify.com