Pixel Auditor requests the minimum permissions required to function. Each is used only for the purpose described below — there is no data exfiltration of any kind. See the Privacy Policy for the full statement.
| Permission | Purpose |
|---|---|
storage | Persists Saved Runs, watched events, snapshots, and theme preference in chrome.storage.local. Local to your device. |
tabs | Reads the active tab's URL so the panel shows data for the correct page and switches state when you change tabs. |
webNavigation | Detects when you navigate to a new page so detection state can be cleared cleanly. No browsing history is stored. |
sidePanel | Opens the Pixel Auditor UI alongside the page when you click the toolbar icon. |
notifications | Used only when you've set a watch and a matching event fires. Required for desktop notifications. → Watch for Event |
<all_urls> | Allows the content script to run on any webpage so detection works across any site you visit. No page data ever leaves your device. |
What Pixel Auditor does NOT request
- No
cookiespermission. Cookie detection readsdocument.cookieon the active page only. - No
history,bookmarks,downloads— none of those are needed. - No remote code. Manifest V3 requires
content_security_policywith no remote script hosts. Pixel Auditor's CSP isscript-src 'self'; object-src 'self';with no exceptions.
audit
Every permission was reviewed against actual API usage during the v2.0 MV3 compliance audit. Anything not used was removed before submission to the Chrome Web Store.