feat(extension): expand permissions and improve media detection

PRIVACY.md

@@ -1,72 +1,67 @@
 # Privacy Policy
 
-Last updated: May 27, 2026
+Last updated: July 31, 2026
 
 ## Overview
 
-Neurobox Media Discord RPC is a browser extension that shows your currently playing YouTube or SoundCloud media as Discord Rich Presence.
+Neurobox Media Discord RPC is a browser extension that displays your active media playback (from YouTube, SoundCloud, or any whitelisted video/audio streaming website) as Discord Rich Presence.
 
-The extension does not sell personal data, does not run ads, and does not use analytics.
+The extension does not sell personal data, does not serve advertisements, and does not collect tracking telemetry or analytics.
 
-## Quick Note (Important)
+---
 
-The Discord OAuth scope of `sdk.social_layer_presence` requests a plethora of other unrelated permissions which many users would consider to be potentially harmful. That, however, is not the case. The scopes that allow the app to set your activity (`rpc.activities.write` and `activities.write`) are currently LOCKED by Discord. They do not give out access to those via applications or support requests, and only a select few Developers are whitelisted to use it. But, `sdk.social_layer_presence` (which is not locked) does implicitly grant developers access to said scope alongside many others that are not available individually. So, unfortunately, in order to set the user's activity, the extension needs to request a lot of unrelated permissions. I apologize for this in advance and can only hope that Discord allows developers to use these scopes without any restrictions in the coming future.
+## Important Note Regarding Discord OAuth Scopes
 
-## Data the Extension Reads
+The Discord OAuth scope `sdk.social_layer_presence` requests permissions that sound broad. Discord's individual activity-writing scopes (`rpc.activities.write` and `activities.write`) are locked by Discord and reserved for whitelisted developer applications. The `sdk.social_layer_presence` scope allows the extension to create and update your Discord activity via headless sessions without running a local RPC desktop server.
 
-When enabled, the extension reads limited playback information from supported media sites:
+---
 
-- Site name, such as YouTube or SoundCloud
-- Media title
-- Channel, uploader, or artist name
-- Current playback time and duration
-- Playback state, such as playing or paused
-- Media URL
-- Artwork or thumbnail URL, when available
+## Data the Extension Reads
 
-The extension reads this information only from supported pages that match its declared permissions.
+When media tracking is enabled and a website is whitelisted by the user, the extension reads basic playback metadata:
 
-## How Data Is Used
+- Platform or site domain name (e.g. YouTube, SoundCloud, or custom site)
+- Media title and uploader/artist name
+- Playback position, total duration, and playback state (playing, paused, speed)
+- Page URL and poster artwork URL (when available)
 
-Playback information is used to create or update your Discord Rich Presence activity.
+The extension only injects media listeners on sites authorized by the user via the domain whitelist.
 
-To do this, the extension sends the current activity data to Discord using Discord's OAuth-authorized API. Discord may display this activity to other users according to your Discord privacy and activity settings.
+---
 
-## Discord Authentication
+## User Privacy & Control Options
 
-The extension uses Discord OAuth to request permission for presence-related functionality. OAuth tokens are stored locally in your browser extension storage so the extension can keep your Rich Presence updated while you use it.
+You have full control over what data is sent to Discord:
 
-The extension does not receive or store your Discord password.
+- **Show URL Toggle**: When disabled, page URLs and domain names are stripped from Discord activity text and buttons.
+- **Custom Target URL**: Allows you to replace the destination link with a custom link of your choice.
+- **Custom Official Platform Name**: Allows you to rename third-party streaming sites to an official service name (e.g. Netflix, Prime Video).
+- **Status Wording Controls**: Customize or disable action wording prefixes (*Watching*, *Listening to*, *Browsing*, *Idling on*, or *None*).
+- **YouTube Channel Toggle**: Toggle whether the uploader's channel name appears in your status.
 
-## Data Storage
+---
 
-The extension stores the following data locally in your browser:
+## Local Data Storage
 
-- Discord OAuth tokens
-- Extension settings, such as whether YouTube or SoundCloud presence is enabled
-- Temporary session data used to update or clear Discord Rich Presence
+All settings are stored strictly on your local device inside your browser's extension storage (`chrome.storage.local` / `browser.storage.local`):
 
-This data stays on your device unless it is sent to Discord as part of the Rich Presence functionality.
+- Discord OAuth authentication tokens
+- User domain whitelist (`rpcWhitelist`)
+- Domain overrides (`mediaOverrides`)
+- Extension preferences (`showUrl`, `showYoutubeChannel`, `actionWording`)
 
-## Data Sharing
+No data is sent to external developer servers, analytics services, or third parties other than Discord.
 
-The extension sends playback activity data to Discord only when you connect Discord and enable presence updates.
+---
 
-The extension does not share data with the developer, advertisers, analytics providers, or any third-party service other than Discord for the purpose of updating Rich Presence.
-
-## User Controls
+## Data Sharing
 
-You can:
+Playback information is transmitted directly to Discord's official OAuth API (`https://discord.com/api/v10`) solely to display your Rich Presence activity. Discord displays this activity according to your Discord account privacy settings.
 
-- Enable or disable all presence updates from the extension popup
-- Enable or disable supported sites individually
-- Clear your current Discord presence from the extension popup
-- Disconnect Discord from the extension popup
-- Revoke the extension's Discord authorization from your Discord account settings
-- Remove locally stored extension data by uninstalling the extension or clearing extension storage
+---
 
 ## Contact
 
-For questions or issues:
+For questions or security inquiries:
 
 me@yaw.cx

README.md

@@ -1,17 +1,109 @@
 # Neurobox - Discord RPC Extension
 
-Shows the currently playing YouTube video or SoundCloud track in Discord Rich Presence from Chrome, Edge, or Firefox.
+A privacy-first Web Extension that automatically displays your media playback in Discord Rich Presence across Chrome, Firefox, Edge, and Brave—without requiring native desktop apps or local servers.
 
-This uses Discord OAuth with `openid sdk.social_layer_presence` and updates a Discord headless session from the extension. No native host required.
+## Screenshots
 
-## Quick Note (Important) - Read PRIVACY.md for more information
+<table border="1">
+  <thead>
+    <tr>
+      <th align="center" width="310">Extension Control Panel</th>
+      <th align="center">Discord Presence Examples</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <!-- Left Column: Fixed to match the natural width of the extension popup -->
+      <td valign="top" align="center" width="310">
+        <img src="assets/popup-screenshot.png" alt="Extension Control Panel" width="100%">
+      </td>
+      <!-- Right Column: Contains the vertically stacked inner table -->
+      <td valign="top">
+        <table border="1" style="margin: 0 auto; text-align: center; width: 100%;">
+          <thead>
+            <tr>
+              <th width="180">Platform / Context</th>
+              <th>Preview</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr>
+              <td valign="middle"><strong>YouTube Video</strong></td>
+              <td><img src="assets/discord-rpc-1.png" alt="Discord Presence of Youtube Video" width="100%"></td>
+            </tr>
+            <tr>
+              <td valign="middle"><strong>Universal Web Media</strong></td>
+              <td><img src="assets/discord-rpc-2.png" alt="Discord Presence of Universal Web Media" width="100%"></td>
+            </tr>
+            <tr>
+              <td valign="middle"><strong>YouTube Music</strong></td>
+              <td><img src="assets/discord-rpc-3.png" alt="Discord Presence of Youtube Music" width="100%"></td>
+            </tr>
+          </tbody>
+        </table>
+      </td>
+    </tr>
+  </tbody>
+</table>
 
-The Discord OAuth scope of `sdk.social_layer_presence` requests a plethora of other unrelated permissions which many users would consider to be potentially harmful. That, however, is not the case. The scopes that allow the app to set your activity (`rpc.activities.write` and `activities.write`) are currently LOCKED by Discord. They do not give out access to those via applications or support requests, and only a select few Developers are whitelisted to use it. But, `sdk.social_layer_presence` (which is not locked) does implicitly grant developers access to said scope alongside many others that are not available individually. So, unfortunately, in order to set the user's activity, the extension needs to request a lot of unrelated permissions. I apologize for this in advance and can only hope that Discord allows developers to use these scopes without any restrictions in the coming future.
 
-### Copyright (C) 2026 Sheathed
+## Key Features
 
-This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, version 3.
+### Universal Web Media Detection
+* **Any Video or Audio Site**: Enable Discord Rich Presence on any website (e.g., Netflix clones, movie streaming sites, custom video portals) using domain whitelisting in the popup.
+* **Embedded Iframe Support**: Tracks video players embedded inside cross-origin `iframe` elements.
+* **Automatic Title Cleaning**: Strips site junk, age ratings (`U/A 13+`), runtimes (`2h 12m`), and plot synopses to produce clean movie titles.
+* **Poster Extraction**: Automatically extracts high-resolution movie poster images (`og:image` / `twitter:image`).
 
-This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
+### YouTube & YouTube Music Enhancements
+* **Smart Category Detection**: Distinguishes between **YouTube Videos**, **YouTube Shorts**, and **YouTube Music**.
+* **Uploader Avatar Badge**: Displays the uploader's channel avatar as a small badge on the Discord status card.
+* **Playback Speed Indicator**: Appends live playback speed indicators (e.g. `1.5x speed`) when watching at non-standard speeds.
+* **Instant SPA Navigation**: Instantly updates status when switching between videos, Shorts, or recommendations without page reloads.
+* **YT Channel Toggle**: Toggle whether the channel name appears in your status.
 
-You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
+### Privacy & Customization Controls
+* **Show URL Toggle**: Hide website domain names and link buttons completely for total privacy.
+* **Custom Status Wording**: Select between **Auto**, **Watching**, **Listening to**, **Browsing**, **Idling on**, or **None**.
+* **Custom Official Platform Name**: Make third-party streaming sites display as official services like `Netflix`, `Prime Video`, `Disney+`, or `IMDb`.
+* **Custom Target URL**: Override button links to point to any custom URL.
+* **Manual Title & Poster Overrides**: Override movie titles or poster images per website.
+* **Discord Rate Limit Cooldown**: Graceful handling of Discord's HTTP 429 rate limit window.
+
+---
+
+## Installation & Setup
+
+### Firefox (Manifest V3)
+1. Open Firefox and navigate to `about:debugging#/runtime/this-firefox`.
+2. Click **Load Temporary Add-on...**
+3. Select `manifest.json` from the Neurobox directory.
+
+### Chrome / Edge / Brave
+1. Open your browser and navigate to `chrome://extensions`.
+2. Enable **Developer mode** in the top-right corner.
+3. Click **Load unpacked** and select the Neurobox project folder.
+
+### Connecting Discord
+1. Click the Neurobox extension icon in your toolbar.
+2. Click **Connect Discord** to sign in with your Discord account.
+3. Once connected, your active video/audio playback will automatically show on your Discord profile!
+
+---
+
+## Privacy Notice (Important)
+
+This extension uses Discord OAuth with the `openid sdk.social_layer_presence` scope to set your Discord Rich Presence via headless sessions.
+
+> **Why does Discord request so many permissions?**
+> The Discord OAuth scope `sdk.social_layer_presence` requests permissions that sound broad. This is because Discord's individual activity-writing scopes (`rpc.activities.write` and `activities.write`) are locked to developer-whitelisted apps. The `sdk.social_layer_presence` scope grants access to set user presence without running a local RPC server. Your data is kept strictly local in your browser and is never stored on external tracking servers.
+
+---
+
+## License
+
+Copyright (C) 2026
+
+This program is free software: you can redistribute it and/or modify it under the terms of the **GNU Affero General Public License** as published by the Free Software Foundation, version 3.
+
+See the [LICENSE](LICENSE) file for more details.