What each extension can reach, why it needs that, and what none of them ever do. If anything here doesn’t match what you see in Chrome’s permission prompt, trust the prompt and email us — that would be a bug worth knowing about.
| Extension | Install-time permissions | Why |
|---|---|---|
| Color Contrast Checker — ContrastForge | activeTab, scripting, storage |
Reads colours from the one tab you invoke it on. No access to any other site. |
| Full Page Screenshot | activeTab, scripting, storage, downloads, offscreen |
Captures the tab you are on and saves the file. The offscreen document exists only to stitch the image together. |
| Modify HTTP Headers — HeaderForge | declarativeNetRequest, declarativeNetRequestFeedback, webRequest, storage, access to all sites |
Header rules are applied by Chrome itself at the network layer. The feedback permission shows you when your own rule fired. webRequest is used observe-only for the Pro live request list, only while its popup is open. The extension never reads page content. |
| Text Expander — SnippetForge | Access to all sites, storage |
A text expander has to see typing in whatever field you are using. This is the broadest access we ask for anywhere, and the reason is explained in full on its privacy page. |
Some features genuinely need more access than the install prompt covers. Rather than ask for everything up front, those are optional: Chrome asks only at the moment you use the feature, and declining leaves the rest of the extension working exactly as before.
{clipboard} placeholder.You can revoke any of these at any time in Chrome’s extension settings.
HeaderForge and Full Page Screenshot can copy their settings to your other computers through Chrome’s own Sync, if you switch that on. For HeaderForge that includes your rules, which can contain tokens, so it is off until you turn it on. It goes through Google’s Chrome Sync, not through us.
One address: https://api.lemonsqueezy.com/v1/licenses/validate. It is sent
when you activate Pro, then at most once a day while Pro is on, and contains only your licence key. Lemon Squeezy is our
payment provider. Nothing else leaves your machine — not the pages you scan, capture, or
type on. The one exception is optional: HeaderForge’s welcome page has a button that sends three
test requests to httpbin.org to prove a test rule works.
You can check this yourself: search any extension’s source for
fetch(. It appears in common.js, plus HeaderForge’s welcome.js for that test.
The rule we hold ourselves to: ask for the narrowest thing that makes the feature work, at the latest moment it is needed. Where a broad permission is genuinely unavoidable — SnippetForge is the honest example — we say so plainly rather than burying it, and we explain exactly what the code does with it.