<\/p>\n
\u26a0\ufe0f Important: NOTAMSpot is an independent browser extension. The permissions listed below are required to analyze publicly accessible aviation portals. This extension is not affiliated with, endorsed by, or certified by FAA, NOAA, DECEA, Nav Canada, or any government agency.<\/p>\n<\/div>\n
Document date:<\/strong> January 2, 2026 This document provides detailed technical justification for each permission declared in the NOTAMSpot manifest.json. Each permission is linked to one or more specific extension features and is used only to the extent necessary to fulfill the avionics safety analysis function (NOTAM, METAR, TAF).<\/p>\n Guiding principle: :<\/strong> minimum necessary scope. No permission is used for secondary purposes, non-consented telemetry, or broad browsing data collection.<\/p>\n <\/p>\n <\/p>\n \ud83d\udcc4 Learn more about data handling:<\/strong> json<\/strong><\/p>\n Description<\/strong><\/p>\n Allows the extension to access the content of the browser\u2019s active tab to automatically analyze critical aeronautical information (NOTAM, METAR, TAF).<\/p>\n Automated Operation<\/strong><\/p>\n NOTAMSpot operates in a proactive and automated way to reduce the cognitive load on the aircraft operator:<\/p>\n Automatic Domain Detection<\/strong><\/p>\n User opens an official aeronautical portal page (e.g., AISWEB, REDEMET).<\/p>\n<\/li>\n The system automatically verifies whether the domain is in the approved whitelist.<\/p>\n<\/li>\n It identifies the expected content type (NOTAM or Weather).<\/p>\n<\/li>\n<\/ul>\n<\/li>\n Real-Time Analysis<\/strong><\/p>\n The extension monitors page loading.<\/p>\n<\/li>\n As soon as the DOM is ready, it starts scanning for critical terms.<\/p>\n<\/li>\n It automatically highlights operational safety keywords.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n Continuous Processing<\/strong><\/p>\n The system continues monitoring dynamic updates (new NOTAMs, updated METARs).<\/p>\n<\/li>\n It applies visual highlighting without manual intervention.<\/p>\n<\/li>\n It updates tooltips and warnings as the content changes.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n Typical Use Cases<\/strong><\/p>\n \u2705\u00a0Automatic Analysis (Default Mode)<\/strong><\/p>\n User opens The system detects: whitelisted domain + NOTAM profile.<\/p>\n<\/li>\n It automatically highlights critical terms: CLSD, INOP, EMERGENCY.\u00a0 No manual action is required.<\/strong><\/p>\n<\/li>\n<\/ul>\n \u2705\u00a0On-Demand Analysis (Optional)<\/strong><\/p>\n User hovers over the lateral floating widget and opens the popup.<\/p>\n<\/li>\n User selects text and uses the context menu \u201c\ud83d\udd0d Forced Search\u201d.<\/p>\n<\/li>\n Therefore, the analysis will be forced onto the current page and the active search profile in the settings.<\/p>\n<\/li>\n<\/ul>\n Justification for Automatic Mode<\/strong><\/p>\n \ud83c\udfaf\u00a0Workload Reduction<\/strong><\/p>\n Aeronautical operators handle dozens of NOTAMs and METARs per shift.<\/p>\n<\/li>\n Manually analyzing each document is operationally impractical.<\/p>\n<\/li>\n Automation enables instant identification of critical risks.<\/strong><\/p>\n<\/li>\n<\/ul>\n \u26a1\u00a0Operational Safety<\/strong><\/p>\n Critical information (runway closed, equipment inoperative) cannot be missed.<\/p>\n<\/li>\n Automatic highlighting ensures the operator immediately sees risk terms.<\/p>\n<\/li>\n Supports ICAO Annex 15 principles for effective dissemination of aeronautical information.<\/p>\n<\/li>\n<\/ul>\n \ud83d\udd12\u00a0Controlled Scope<\/strong><\/p>\n Automation is restricted to whitelisted domains (official aeronautical portals).<\/p>\n<\/li>\n Analysis does not run on banking sites, social networks, or generic pages.<\/p>\n<\/li>\n Technical Details<\/strong><\/p>\n Data Accessed<\/strong><\/p>\n \u2705 Page textual content (only on whitelisted domains) Why It Is Necessary<\/strong><\/p>\n Risk identification: Detecting critical terms without manual analysis.<\/p>\n<\/li>\n Operational efficiency: Processing multiple documents simultaneously.<\/p>\n<\/li>\n Regulatory compliance: Meeting ICAO requirements for effective information processing.<\/p>\n<\/li>\n<\/ul>\n Security Impact<\/strong><\/p>\n \u2705\u00a0Low risk<\/strong>\u00a0with multiple layers of mitigation:<\/p>\n Mitigation 1: <\/strong> Restrictive whitelist<\/p>\n<\/li>\n Mitigation 2: <\/strong> Mandatory HTTPS validation<\/p>\n<\/li>\n Mitigation 3:<\/strong> Secure context verification ( Mitigation 4: <\/strong> Manifest V3 isolated content scripts (no access to the page\u2019s global Mitigation 5: <\/strong> No transmission of analyzed data to external servers<\/p>\n<\/li>\n<\/ul>\n Allows the extension to read and write local data using the Stored data includes:<\/p>\n UI preferences: <\/strong> selected language (pt-BR, en-US, es-ES, fr-FR)<\/p>\n<\/li>\n Analysis profiles: <\/strong> which aeronautical authorities are enabled<\/p>\n<\/li>\n Visual options: <\/strong> highlight preferences (colors, styles), light\/dark mode<\/p>\n<\/li>\n Validation cache: <\/strong> previously verified domains to optimize future checks<\/p>\n<\/li>\n Session state: <\/strong> extension state across reloads<\/p>\n<\/li>\n<\/ul>\n \u274c Browsing history<\/p>\n<\/li>\n \u274c Open tab data<\/p>\n<\/li>\n \u274c Content of analyzed NOTAMs\/METARs\/TAFs<\/p>\n<\/li>\n \u274c User identifiers or IP addresses<\/p>\n<\/li>\n \u274c Cookies or authentication tokens<\/p>\n<\/li>\n \u274c Any personally identifiable information (PII)<\/p>\n<\/li>\n<\/ul>\n All data is stored locally on the user's device. No data is transmitted to NOTAMSpot servers during storage. The data remains in the local browser profile.<\/p>\n javascript<\/strong><\/p>\n Persistence:<\/strong> Keep user preferences across sessions.<\/p>\n<\/li>\n Offline:<\/strong> The extension works without an internet connection (local checks continue).<\/p>\n<\/li>\n Efficiency:<\/strong> Decision caching reduces reprocessing.<\/p>\n<\/li>\n<\/ol>\n \u2705\u00a0Low risk.<\/strong>\u00a0The data is non-sensitive (UI preferences) and remains on the device. Users can clear the data by accessing\u00a0 It allows the extension to access information about open tabs, including URLs, titles, and statuses.<\/p>\n json<\/strong><\/p>\n javascript<\/strong><\/p>\n
\nRecipient:<\/strong>\u00a0Review Teams \u2014 Chrome Web Store, Mozilla Add-ons, Microsoft Edge Add-ons
\nDeveloper:<\/strong> NOTAMSpot Team<\/p>\n
\nOverview<\/h2>\n
\nPrivacy Policy<\/a> |
\nData Transparency<\/a><\/p>\n
\nDeclared Permissions<\/h2>\n
{\r\n\"permissions\": [\r\n\"activeTab\",\r\n\"storage\",\r\n\"tabs\",\r\n\"downloads\"\r\n]\r\n}<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
\n1.
activeTab<\/code><\/h2>\n\n
\n
\n
\n
\n
https:\/\/aisweb.decea.mil.br\/?i=aerodromos&codigo=SBBR<\/code><\/p>\n<\/li>\nCLSD<\/code>,\u00a0INOP<\/code>,\u00a0EMERGENCY<\/code><\/p>\n<\/li>\n\n
\n
\n
\n
SecurityWhitelist <\/code> silently disables itself in non-approved contexts.<\/p>\n<\/li>\n<\/ul>\n\/\/ Automatic activation flow<\/span>\n1.<\/span> Content script loads on page<\/span> (<\/span>manifest content_scripts)<\/span>\n2.<\/span> security-whitelist.js checks hostname\n3.<\/span> If hostname \u2208 APPROVED_DOMAINS<\/span>:<\/span> \na.<\/span> Identifies profile<\/span> (<\/span>NOTAM<\/span> vs METAR<\/span> vs TAF<\/span>)<\/span> \nb.<\/span> Load dictionary of critical terms \nc.<\/span> Starts automatic DOM<\/span> parsing \nd.<\/span> Applies visual highlighting\n4.<\/span> If hostname \u2209 APPROVED_DOMAINS<\/span>:<\/span> \na.<\/span> Disables silently \nb.<\/span> No processing performed\n<\/code><\/pre><\/div>\n<\/div>\n<\/div>\n
\n\u2705 DOM structure to apply visual highlighting
\n\u274c Forms, password fields, or login data
\n\u274c Cookies or authentication tokens
\n\u274c Browsing history or background tabs<\/p>\n\n
\n
window.isSecureContext<\/code>)<\/p>\n<\/li>\nwindow<\/code>)<\/p>\n<\/li>\n
\n2.\u00a0
storage<\/code><\/h2>\nDescription<\/h2>\n
chrome.storage.local<\/code> and chrome.storage.sync<\/code> APIs (where applicable).<\/p>\nData Stored<\/h2>\n
\n
Data NOT Stored<\/h2>\n
\n
Data Location<\/h2>\n
Technical Details<\/h2>\n
\/\/ Local storage example<\/span>\nchrome.<\/span>storage.<\/span>local.<\/span>set<\/span>(<\/span>{<\/span> \n'language'<\/span>:<\/span> 'pt-BR'<\/span>,<\/span> \n'activeProfiles'<\/span>:<\/span> [<\/span>'NOTAM'<\/span>,<\/span> 'METAR'<\/span>]<\/span>,<\/span> \n'highlightColor'<\/span>:<\/span> '#FFD700'<\/span>\n}<\/span>)<\/span>;<\/span>\n\n\/\/ Data does not leave the device<\/span>\n\/\/ No calls to servers external<\/span>\n<\/code><\/pre><\/div>\n<\/div>\n<\/div>\nWhy It Is Necessary<\/h2>\n
\n
Security Impact<\/h2>\n
chrome:\/\/settings \u2192 Privacy \u2192 Clear browsing data<\/code>.<\/p>\n
\n3.
tabs<\/code><\/h2>\nDescription<\/h2>\n
Information Accessed<\/h2>\n
{<\/span> \n\"url\"<\/span>:<\/span> \"https:\/\/aisweb.decea.mil.br\/AIS\/\"<\/span>,<\/span> \n\"title\"<\/span>:<\/span> \"AISWEB - Aeronautical Information Portal\"<\/span>,<\/span> \n\"status\"<\/span>:<\/span> \"complete\"<\/span>,<\/span> \n\"active\"<\/span>:<\/span> true<\/span>,<\/span> \n\"windowId\"<\/span>:<\/span> 1<\/span>,<\/span> \n\"id\"<\/span>:<\/span> 123456<\/span>\n}<\/span>\n<\/code><\/pre><\/div>\n<\/div>\n<\/div>\nSpecific Usage<\/h2>\n
1. Domain check<\/h2>\n
\/\/ SecurityWhitelist checks the URL to decide whether to activate<\/span>\nconst<\/span> urlObj =<\/span> new<\/span> URL<\/span>(<\/span>tab.<\/span>url