Update README to clarify what data is collected

[gabrielgrant]

According to the README "Your data is not sent anywhere[...] It won’t store anything remotely or send data anywhere else", however the extension seems to be doing tracking with Sentry, meaning at least some data is being sent/stored remotely. In order to really trust this to deal with a lot of pretty sensitive info, would appreciate a more thorough explanation of exactly what data is intended to be collected/stored and a real evaluation of how/whether personal info or transaction data could end up being transmitted (eg as context in the event of errors?)

[idpaterson]

This is a good idea, Monarch should clarify whether Sentry data is scrubbed to redact sensitive data or if nothing sensitive is sent in the first place.

To chip away at the question, the extension uses Sentry only in the popup and background service worker that processes exports. Sentry is not loaded in to the Mint website so there will be no accidental leaks from your interaction with the Mint website. The extension prohibits Sentry from sending your IP address and email, so users are anonymous.

In my experience with Sentry, the URL of any Mint API request that fails in the service worker may be logged. However, the url has no identifying data unless the body and headers of the request are also captured. Monarch can chime in, but I don’t believe Sentry collects those.

Otherwise, errors that occur in the extension code are recorded and Monarch can confirm whether any personal data is attached to reported script errors.

Great question!

[oaosman84]

Hey guys,
Yea we were primarily using Sentry to debug errors, and sensitive data was all scrubbed / not sent.

That said, given that we aren't actively contributing to this extension, if someone wants to put forward a PR disabling or removing Sentry completely, we'd be happy to get that merged. We're not really looking at the stack traces actively, it's more of a "just in case" thing.