devplacepy/nodes/extension/ui/disclosure.html

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>DevPlace Node: what is shared</title>
  <link rel="stylesheet" href="popup.css">
</head>
<body class="page">
  <main>
    <h1>Before you share anything</h1>
    <p class="muted">DevPlace Node lets the community use a little of your internet connection to read public pages from sites that block data centers. Read this once. Nothing runs until you accept and switch it on.</p>

    <section class="card">
      <h2>What passes through your browser</h2>
      <ul>
        <li>The <strong>address of the page</strong> that is requested (host and full URL), for example a public Reddit thread.</li>
        <li>The <strong>page content</strong> that comes back. It is read by this extension and sent to the DevPlace server.</li>
        <li>Your <strong>public IP address</strong> is what the destination site sees. That is the point of donating.</li>
        <li>How many requests and how many bytes you moved, counted on this device and on the server.</li>
      </ul>
    </section>

    <section class="card">
      <h2>What is never used</h2>
      <ul>
        <li>Your <strong>cookies, logins and accounts</strong>. Every request is sent without credentials, so you are never signed in as yourself.</li>
        <li>Your browsing history, open tabs and other sites.</li>
        <li>Any host outside the built-in list, any port other than the standard secure one, any address inside your own network.</li>
      </ul>
    </section>

    <section class="card">
      <h2>You stay in control</h2>
      <ul>
        <li>One on/off switch in the popup. Off means disconnected.</li>
        <li>A daily data cap, a parallel request cap and optional active hours, enforced on this device even if the server asks for more.</li>
        <li>Live counters of requests and bytes in the popup.</li>
        <li>You can forget the device secret at any time, and revoke the device on your DevPlace profile.</li>
      </ul>
      <p class="muted">Pages fetched through your connection are public pages. Do not donate from a connection whose address you cannot afford to have associated with that traffic.</p>
    </section>

    <section class="card">
      <div class="row">
        <button type="button" class="primary" id="accept">I understand, allow it</button>
        <button type="button" id="decline">Not now</button>
      </div>
      <p class="error" id="error" role="alert"></p>
      <p class="muted" id="done"></p>
    </section>
  </main>
  <script type="module" src="disclosure.js"></script>
</body>
</html>