gh-christianlouis-docuelevate/browser-extension/PERMISSIONS.md

Browser Extension Permissions

This document explains the permissions requested by the DocuElevate browser extension.

Requested Permissions

The extension requests the following permissions in manifest.json:

activeTab

• Purpose: Get the URL of the currently active tab
• Usage: When you click the extension icon, it reads the current tab's URL to display in the popup
• Privacy: Only accesses the active tab when you explicitly open the popup
• Alternative: Without this, the extension couldn't show you which file you're sending

storage

• Purpose: Save your configuration (server URL and session cookie)
• Usage: Stores your DocuElevate server URL and optional session cookie locally
• Privacy: All data stays on your device; nothing is sent to third parties
• Alternative: Without this, you'd need to reconfigure the extension every time

contextMenus

• Purpose: Add "Send to DocuElevate" to the right-click menu
• Usage: Creates a context menu item for quick access
• Privacy: No data access; only adds a menu item
• Alternative: Without this, you'd only have the toolbar icon

notifications

• Purpose: Show success/error notifications
• Usage: Displays browser notifications when files are sent successfully or errors occur
• Privacy: Only shows notifications based on your actions
• Alternative: Without this, you wouldn't get feedback from context menu actions

No Host Permissions

The extension has an empty host_permissions array ([]).

Why Empty?

• Privacy-First: The extension doesn't request blanket access to all websites
• User-Controlled: You configure the DocuElevate server URL, not us
• Minimal Permissions: Only accesses the server you explicitly configure
• Dynamic Access: API requests are made from popup/background scripts, not from web pages

How It Works

1. You configure your DocuElevate server URL in the extension
2. The extension stores this URL in local storage
3. When you send a file, the extension makes a direct API request to your configured server
4. No need for static host permissions because the extension doesn't inject scripts or modify web pages

Comparison to Other Extensions

Many similar extensions request:

• ❌ "<all_urls>" or "*://*/*" - Access to all websites
• ❌ "http://*/*" and "https://*/*" - Access to all HTTP/HTTPS sites

DocuElevate requests:

• ✅ [] - No blanket host permissions
• ✅ Only access to your configured server (via fetch API)

Permission Justification

Permission	Required?	Justification
activeTab	✅ Yes	Must read current tab URL to send files
storage	✅ Yes	Must save configuration to function
contextMenus	⚠️ Optional	Nice to have for quick access
notifications	⚠️ Optional	Nice to have for feedback

Security Benefits

1. No Web Page Access: Extension can't read or modify content on websites you visit
2. No Browsing History: Extension doesn't track your browsing
3. No Cross-Site Access: Extension only talks to your configured server
4. User-Controlled: All communication is initiated by you
5. Transparent: All code is visible in the extension folder

How to Verify Permissions

Chrome/Edge

1. Go to chrome://extensions/ or edge://extensions/
2. Find "DocuElevate - Send to Document Processor"
3. Click "Details"
4. Review "Permissions" section

Firefox

1. Go to about:addons
2. Find "DocuElevate - Send to Document Processor"
3. Click on the extension name
4. View "Permissions" tab

Reducing Permissions Further

If you want even fewer permissions:

1. Remove contextMenus: Delete the contextMenus permission from manifest.json

   • Trade-off: Lose right-click menu option
   • You'd only have the toolbar icon

2. Remove notifications: Delete the notifications permission

   • Trade-off: No success/error notifications
   • You'd only see status in the popup

3. Remove content script: Delete the content_scripts section

   • Trade-off: None (it's not actively used currently)
   • Reduces extension footprint slightly

Privacy Statement

The DocuElevate browser extension:

• ✅ Does NOT collect any personal data
• ✅ Does NOT track your browsing history
• ✅ Does NOT send data to third parties
• ✅ Does NOT modify web page content
• ✅ Does NOT inject ads or tracking scripts
• ✅ Only communicates with YOUR configured DocuElevate server
• ✅ Stores configuration locally on your device only

Questions?

If you have concerns about permissions or privacy, please:

• Review the source code in the browser-extension folder
• Open an issue on GitHub
• Check the Browser Extension Guide

---

Last updated: 2024