Your habitat is local. Its story is yours.

WILDFOLD is a local ecosystem simulation for a woodland and wetland community. You restore terrain, introduce animals, observe their decisions and complete restoration briefs. This policy covers version 1.0.0 of the packaged extension and its bundled privacy page. It describes the actual local data design; it is not a promise that browser storage can never fail or that a game model accurately predicts real wildlife populations.

The extension opens its own application page in a tab when you click its toolbar action. It does not replace your new-tab page, inject controls into websites, or examine a page you are reading. The service worker only handles that opening action. There is no background ecosystem running after the application tab is closed, and no account is required to begin a habitat.

A habitat contains the terrain type and available food of each tile; the species, generated identifier, position, direction, age and sex of each simulated animal; and its hunger, thirst, fatigue, stress and health. Its current behavior, target, route, limited resource memory and recent danger memory are also part of the state. These are fictional simulation attributes, not observations of people or personally identified real animals.

The habitat also contains a pseudorandom generator state, simulation time, climate choice, population events, counters, restoration actions and completed-brief progress. The purpose of retaining these details is to continue the same world and restore a checkpoint consistently. Animal identifiers are local counters, not advertising identifiers. There is no device fingerprint, cross-site identifier or hidden user score.

When the browser permits it, the application stores a workspace in an IndexedDB database named wildfold-v1, in a workspace object store. The current record holds the current habitat and an optional checkpoint. A previous record holds the preceding successfully stored workspace so a damaged current save may be recoverable. The extension does not use chrome.storage.local, chrome.storage.sync, cloud synchronization or browser cookies to store the game.

The previous record is a recovery copy, not an unlimited archive. It can contain an older terrain arrangement or an animal you removed or lost in the current world. Replacing the current world does not immediately erase all earlier information in that previous record or in the checkpoint. Use the explicit erase function to remove both local records, and manage downloaded habitat files separately.

Edits and game progress schedule local saves. While the habitat is running, a periodic save captures the current simulation state; user actions can schedule a save sooner. Writes are debounced and serialized. The interface reports the saving or failure status. A save is only reported as successful after its database transaction completes, rather than merely after placing a write request in a queue.

The application also attempts to flush pending work when the tab becomes hidden or is about to close. Browser shutdown, a crash, a full disk or a terminated tab can interrupt these attempts. Export a portable habitat file before a major change or before relying on a long session being recoverable. Closing the tab does not cause the simulation to advance offline or calculate additional animal losses.

A Web Lock is used to allow one editing tab to own this workspace. A second tab that cannot obtain the lock opens as a viewer rather than silently replacing the first tab’s save. Closing the editing tab and reloading another tab allows the ownership request to be tried again. The lock is a browser coordination mechanism; it is not a user authentication system and does not identify you to any server.

If the required storage or locking facilities are unavailable, the interface explicitly labels the session as temporary. In that mode the world exists in memory, and you need to export it to keep it. The product does not pretend a temporary session is durably saved. A recovery failure also avoids overwriting the unreadable stored world with a fresh one without indicating the problem.

Import occurs only when you choose a habitat file through the application’s file picker. The parser reads the selected file in the current tab and validates the expected format, version, tile count, animal count, numeric ranges, identifiers, routes and memory lists before replacing the current habitat. A rejected file leaves the active world unchanged. The supported input limit is 4 MB.

The extension does not scan folders, enumerate drives, monitor your Downloads directory or retain a directory-access handle. Choosing one file does not give it continuing access to unrelated files. The original input file is not overwritten. Imported state that is accepted becomes part of the local workspace and is therefore subject to the same save, recovery and deletion behavior as a world created inside the game.

Export creates a new .wildfold JSON file through the browser’s ordinary download mechanism. It contains the current world, including needs, routes, memories, seed and restoration progress. It is not an image of the screen. The exported habitat does not include the separate local checkpoint or browser profile settings. Its contents are readable by anyone who obtains the file; export is not encrypted by this application.

Keeping a checkpoint copies the current habitat into the local workspace. Restoring swaps the current world with that checkpoint, which lets you compare an intervention with an earlier state. A new habitat also keeps the previous world as a checkpoint. Downloaded files remain on your computer after a local erase or extension uninstall and must be deleted using your own file-management tools.

The production manifest declares no permissions or host_permissions. In particular, it does not request access to history, bookmarks, activeTab, the clipboard, geolocation, the camera, the microphone or arbitrary file URLs. It does not contain content scripts. Its toolbar action opens a packaged application page without reading the title, URL or contents of your existing tabs.

This minimal manifest does not mean the extension cannot use ordinary capabilities of its own page. Canvas, WebGL, the File API, browser downloads, IndexedDB and Web Locks serve the local simulation. A browser or administrator may disable some of these capabilities. The application does not alter administrator policies, request an exception automatically, or attempt to circumvent a blocked extension installation.

The simulation, models, rendering code, styles and controls are packaged locally. Gameplay does not request remote scripts, textures, fonts, weather, species data or AI inference. There are no fetch calls, WebSocket sessions, tracking pixels or remote analytics endpoints in the application. The content security policy restricts connections and executable code to the packaged behavior rather than allowing arbitrary remote code.

The field guide contains optional natural-history reference links. Nothing is fetched from those sites merely because the guide is displayed. Clicking a link opens that site through the browser; the destination’s own privacy rules then apply. Those links use noopener and noreferrer. The destination can receive the network information ordinarily required to serve your requested page, but it is not sent your habitat data.

AI in WILDFOLD refers to a deterministic, bounded decision model in the extension: needs, local perception, memory, route planning, safety preferences and species parameters. No prompt or conversation is sent to an AI service, and no online model is consulted to decide whether an animal should eat, drink or rest. The simulated entities are not connected to a real animal-tracking system.

Rates, lifetimes and social behavior are simplified for a playable simulation. The community has six species and a fixed population limit. Birds walk or swim rather than fly; disease, genetics, migration and detailed ecological prediction are outside this release. These modeling limits are relevant to understanding the generated state: a hunger value or a hunt counter is game data, not scientific evidence about an actual population.

WILDFOLD does not contain an analytics SDK, advertising library, crash-reporting service, social login, payment service or embedded third-party widget. It does not sell, rent or transmit your habitat to an advertiser or a data broker. There is no remote multiplayer backend, public leaderboard, usage telemetry or cross-device profile associated with an installation.

The browser and distribution store are separate products. They may process installation, update, security or download information under their own policies. That activity is not a habitat-upload feature of WILDFOLD. If you voluntarily send an exported world to another person or upload it to an external service, that transfer happens outside the automatic data behavior described in this policy.

The application imposes no automatic expiry date on the current and previous workspace records. They remain until replaced, explicitly erased, removed with extension data, or lost through browser or system storage management. Storage capacity is not unlimited. The extension does not request unlimitedStorage. A local save can fail when the profile is full or otherwise unable to accept a database transaction.

Choose Habitat files, then Erase local data, and confirm the operation to delete both records. A fresh temporary habitat is displayed afterward; later use can create new saves. Removing the extension or clearing its browser data is another browser-level control. These actions do not reach into downloaded files, backups made by your operating system, or copies you shared elsewhere.

Input validation, bounded file sizes, non-executable JSON, packaged code, text escaping and a restrictive connection policy reduce avoidable risks. The original file is never modified in place. These measures are not a guarantee against every browser, operating-system or hardware vulnerability. Keep your browser updated and import files only from sources you have reason to trust.

Local storage is protected by the browser’s profile and origin model, not by an additional WILDFOLD password. Someone with access to your unlocked computer, browser profile, exported files or system backups may be able to read the habitat. The game does not encrypt exports or provide secure forensic erasure. Use device-level access controls when the surrounding computer contains sensitive information.

Storage, import and graphics failures are shown in the application so you can choose whether to retry, export or restart. There is no automatic remote error report. Development or browser tools may expose local console messages to someone using that same browser, but the extension does not upload the console, the current habitat or an activity log to a support server.

For a useful support report, describe the operation, extension version and visible message. Share a small reproducible habitat only when necessary and after reviewing its contents. A copy you choose to send is outside the extension’s automatic local-only operation. The developer cannot retrieve your browser’s save remotely or restore a file that was never successfully saved or exported.

The extension has no registration, age field, chat, messaging or targeted advertising. It does not deliberately collect contact information from children. A parent, guardian or school administrator can control whether the extension is installed and what files may be imported or exported. The simulation includes predation and animal loss as non-graphic parts of its simplified food web.

A shared browser profile also shares that profile’s saved habitat. There are no separate named players or private subaccounts inside WILDFOLD. Use separate browser profiles or device accounts when different people need independent workspaces. The application does not make a determination of anyone’s age and does not claim to replace an institution’s device-management requirements.

This policy is dated 7 September 2026 and applies to version 1.0.0. A later release that changes data handling should update this document and the distribution listing. The current release has no in-app policy-tracking identifier and no background request that checks whether you have read a new policy. Review the policy accompanying an update when deciding whether to keep using the product.

The responsible publisher is the developer identified on the Chrome Web Store listing from which you install WILDFOLD. Use the verified developer contact shown on that listing for privacy or support questions. For an unpacked development copy, contact the person who supplied it. This package does not invent a company name or mailbox; a publisher must configure a real contact and public policy URL before public distribution.