Documentation
The short version: it runs locally, it asks for as little as it can, and it tells you when it cannot do something.
Getting started
See install for building from source and loading it in Chrome.
Permissions, and why each one exists
| Access | Required? | What it is for |
|---|---|---|
| Current tab | Required | Reading and changing the page you are on, while you use a tool. |
| Injection | Required | Putting the toolbar on the page when you open it. There is no always-on script. |
| Local storage | Required | Your settings, presets and snippets. |
| Downloads | Required | Saving a capture or an export. |
| Cookies | Optional | The Cookie Editor, scoped to the site you are on. Not granted at install. |
| Other domains | Optional | Reading images hosted elsewhere, or your own AI endpoint. Asked per domain. |
| User scripts | Required, but gated by the browser | Running JavaScript you wrote. Chrome requires you to enable it separately. |
What leaves your device
By default, nothing. There is no analytics and no crash reporting. The exceptions are things you start yourself: a download goes to your disk, and the AI Assistant sends your prompt, and page text if you leave that switched on, to the provider whose key you entered. Obvious secrets are masked out of that text first, and form fields are not read at all.
Source
The extension source, its audit notes and its security documentation live in the repository. The audit records open problems as well as fixed ones.