Unbounded by Lantern

Description

Roughly a third of the world’s internet users live behind some form of national
censorship. Unbounded lets the people who visit your site help, without
installing anything: the widget adds a switch to your page, and a visitor who
turns it on lends a small amount of their bandwidth to relay traffic for someone
whose government blocks the open internet.

Nothing happens until a visitor chooses it. The switch is off when the page
loads, and the proxy engine is not even downloaded until it is turned on.
Visitors can turn it off at any time, and closing the tab stops it.

This plugin is the WordPress front end for that widget. It adds a settings
screen for the widget’s appearance and placement, and a checkbox in the page
editor to turn it on for a given page.

What you can configure

• Layout — banner, panel, floating, or simple
• Theme — light, dark, or follow the visitor’s system preference
• Location — top or bottom of the page
• Where it appears — per page via the editor sidebar, on all posts, or on the homepage

Open source

Unbounded is developed in the open at
github.com/getlantern/unbounded.
The plugin source lives in ui/wp-plugin, and the widget it loads is in ui/.

External services

This plugin is a client for the Unbounded network, run by Lantern. The widget
cannot work locally: relaying traffic for someone in another country requires
peers, signaling, and exit infrastructure, all of which live in the service.

When the widget renders on a page — before the visitor has done anything —
their browser contacts:

• embed.lantern.io — serves the widget bundle and its images, and hosts a
  small invisible frame the widget uses to remember volunteering statistics.
• fonts.googleapis.com / fonts.gstatic.com — the widget’s typeface,
  Urbanist, from Google Fonts.
• plausible.io — usage analytics, loaded inside the embed.lantern.io frame.
  On load the widget sends it two events: that it rendered, tagged with the
  embed type (web page or browser extension), and the state of the switch,
  which is off. The switch event is sent again whenever a visitor changes it.
  The load event carries the hostname of the page the widget is embedded on. While
  the switch is on, one further event is sent each time the widget starts
  helping a new person, tagged with the same hostname. Every site that embeds
  the widget is listed automatically on unbounded.lantern.io/leaderboard and
  ranked by these counts. A site that should not appear there can ask to be
  removed at github.com/getlantern/unbounded/issues.
  Plausible’s own script adds its usual page metadata, including the frame’s
  referrer — the site the widget is embedded on, usually just the origin, as
  trimmed by that site’s referrer policy. Plausible is cookieless and keeps no
  persistent identifier for the visitor; Lantern uses the counts to report how
  many sites run the widget and how many visitors volunteer.

Nothing else is contacted until a visitor turns the switch on. After that:

• embed.lantern.io — the WebAssembly proxy engine, around 12 MB, which is
  why it is fetched on demand from the service rather than bundled into this
  plugin.
• geo.getiantem.org — a country lookup, used to draw the map and to warn
  visitors who appear to be in a censored region that volunteering may not be
  appropriate for them.
• freddie.iantem.io — peer discovery and connection signaling.
• unbounded.iantem.io — the exit servers that relayed traffic egresses
  through. If the widget’s page freezes or crashes, a diagnostic report is also
  sent here: timing measurements, the page’s address, the browser’s user-agent
  string, and the widget build. It carries no identifier for the visitor.
• netstated-d7bbec1ed55b.herokuapp.com — anonymous network-state updates
  that power the live map of active connections.

What is kept in the visitor’s browser

The widget stores a few values in browser storage: the interface language, a
crash-recovery marker, and — inside the embed.lantern.io frame, so it follows
the visitor across sites that run the widget — running totals of people
helped. None of it identifies the visitor.

Unbounded does not track visitors, set advertising identifiers, or collect
personal data. Relayed traffic is end-to-end encrypted between the person being
helped and their destination; a volunteering browser cannot read it.

• Privacy policy: https://lantern.io/privacy
• Terms of service: https://lantern.io/terms

By installing and enabling this plugin you are choosing to load the widget from
these services on the pages you enable it for. Please tell your visitors, and
add it to your own privacy policy if you have one.