Must the plugin access all your web traffic?

[Paddy5150]

Is there any way to make it only act locally, and no data on your browsing be sent out?

Anything else is a privacy fail.

I was prompted to write this after seeing the attached warning on the .org website.

[sidvishnoi]

Although this issue belongs to web-monetization-extension repo, I'd answer your concerns here.

The extension requires the "all hosts" permission to:

• read the page content to find the <link rel="monetization"> elements to monetize (including from iframes)
• emit events such that load, error, and monetization on relevant link tags, and defining interfaces such MonetizationEvent in page's context

No browsing data is ever sent out from the extension.

Following are the only network requests from the extension that can be treated as "non-local":

• Fetching wallet address info from the link tags
• Creating Open Payments grants and creating payments to above wallet addresses (and other requests in the Open Payments flow).
• Some raw JSON data is fetched from pre-defined URLs to do some currency conversions when connecting wallet, and sometimes before doing cross-currency payments.

Also, no data about the websites you visit is sent to wallet providers.

As of today, there's no telemetry data in extension either.

While we understand this is a broad permission which can seem suspicious, we'd have used a more explicit permissions if browsers allowed so. It is similar to the permission for ad-blockers and password managers - they do not send browsing data outside either, but this permission is needed for the basic functionality.
An alternative to this was "activeTab" permission, but that would require user interaction whenever you visit a website, and it will break the automatic seamless micropayments flow (which is fundamental to Web Monetization).

The extension source code is publicly viewable if you've any concerns regarding privacy. I hope this answers your questions.