Privacy Thing

One configuration for a specific website

Profiles and domain rules form the foundation of the product. A profile describes selected environment parameters, while rules determine where it applies. On Firefox, configuration can also account for the active container. The same user can therefore apply different settings depending on the website and browsing context.

A popup provides quick control over the current domain, while the complete settings application supports profiles and rules, configuration import and export, logs, and site-data management. I also designed X-Ray, a panel that shows which supported data and browser features the active site accesses and which Privacy Thing settings affect them. Protection becomes something users can inspect for themselves rather than an invisible mechanism working in the background.

The hardest part: getting there first

Changing the behavior of browser APIs is only part of the challenge. The change must also happen before a website can read the real values. A later correction cannot undo information exposed during the first moments of document loading.

I built a dedicated runtime and mechanisms that deliver the correct configuration while navigation is still in progress. They must remain stable across settings changes, page reloads, and repeated activation without accumulating additional layers of modification. Reliability and timing proved more difficult than replacing the data itself.

Many contexts and two environments

Modern web applications run code not only in the top-level window, but also in frames and several kinds of workers. Each of these contexts can see a different part of the environment, so the active Privacy Thing configuration must reach beyond the main document without disrupting mechanisms the application itself relies on.

Differences between Chromium and Firefox add another layer of complexity. Both environments offer similar extension models, but they launch page code and deliver data in different ways. I separated shared product behavior from adapters responsible for each browser's constraints. This makes it possible to develop one feature for both versions and verify them against the same scenarios.

Quality verified in real browsers

Privacy Thing changes the behavior of native APIs, so unit tests alone are not enough. The project combines them with integration coverage and automation running in real Chromium and Firefox builds. Tests cover areas including the earliest reads during page loading, frames, workers, headers, and complete interface workflows.

As the project grew, I extracted shared libraries for geolocation, time, fingerprinting protection, browser integration, and diagnostics. The repository also contains dedicated test pages and tooling for detecting differences between declared browser support and the capabilities available in practice.

Privacy and product boundaries

Profiles, rules, settings, and logs remain in the user's browser. Privacy Thing has no telemetry backend and does not load remote executable code. Map and location-search features use OpenStreetMap and Nominatim only after the user deliberately activates them.

Privacy Thing is neither a VPN nor a proxy. It does not change the public IP address or promise anonymity or undetectability. Its purpose is precise, verifiable control over the information a browser extension can genuinely influence.

The project remains under active development and is being prepared for public release. What began as a coordinate replacement experiment has become a cross-browser product combining environment control, visible diagnostics, and the engineering foundation required to verify its behavior under real conditions.