`extension-v0/README.md`

70 lines
# SDCC Borrower Helper — v0.1 prototype

Privacy-first browser extension for federal student loan borrowers.

## Install (developer mode)

1. Open `chrome://extensions` in Chrome / Edge / Brave
2. Toggle **Developer mode** (top-right)
3. Click **Load unpacked**
4. Select this directory (`extension-v0/`)
5. The extension will appear in your toolbar — pin it for easy access

## What it does

- **On Page tab** — when you're on `studentaid.gov`, NSLDS, MOHELA, Aidvantage, Nelnet, or EdFinancial, scans the page locally for loan-data signals (balance, IDR plan, servicer name) and tells you what it found. Nothing leaves the browser.
- **PSLF tab** — quick eligibility check based on loan type + employer + qualifying payments
- **IDR tab** — side-by-side: SAVE (paused) / PAYE / new IBR
- **Letter tab** — paste a confusing servicer letter, get plain English (rule-based; production version uses local LLM)
- **Links tab** — direct bookmarks to the trusted federal sources

## Verify the privacy claim

The extension makes **zero outbound network requests**. To confirm:

1. Open `chrome://extensions` → **Inspect views: service worker** (none — there is no background script)
2. Open the popup → right-click → Inspect → Network tab → use any feature → confirm 0 requests
3. Inspect `manifest.json` — no `background` key, no `webRequest` permission, no `connect-src` other than `'self'`
4. Reproducible build: this entire extension is a few static files. SHA the directory; verify against published build hash.

## Permissions

- `storage` — for popup state only (form values), never synced
- `activeTab` — to read the URL of the page you're currently looking at (not other tabs)
- `host_permissions` for the 6 federal/servicer domains — content script reads page DOM passively

The extension does NOT request: `tabs` (full URL access), `webRequest`, `cookies`, `history`, `<all_urls>`, identity, geolocation, or any other broad permission.

## File structure

```
extension-v0/
├── manifest.json          MV3 spec — 4 host permissions, 0 broad permissions
├── popup.html             Popup UI (5 tabs)
├── popup.js               All client-side logic
├── content/
│   ├── badge.js           Floating badge on federal pages
│   └── badge.css          Badge styles (scoped via #sdcc-helper-badge)
├── icons/
│   ├── icon16.png         16×16 toolbar icon
│   ├── icon48.png         48×48 management page
│   └── icon128.png        128×128 store listing
└── README.md              this file
```

## What's NOT in v0.1

- Real federal page DOM extraction (current version reads `body.innerText` for keyword signals only)
- LLM-based letter translation (current uses 8 hardcoded patterns)
- Auto-fill into PSLF ECF / IDR application forms
- Servicer-specific data extraction
- Spanish UI

## License

MIT — open source on day one. Source of truth: SDCC's GitHub (TBD). Reproducible builds enable anyone to verify the extension behaves identically to the source.

## Why this is unusual

Most fintech apps in this space (Summer, Savi, Chipper) ingest your data to their servers — they have to, given their business model. SDCC is a non-profit advocacy org; we don't need your loan numbers to do our mission. This extension is the architectural proof that helpful is possible without surveillance. Read the full legal/technical analysis at https://sdccanalysis.agentabrams.com/extension.html.