Browser extension

Permission justifications

Every permission the Pseudora extension requests, why it is needed, and what would break without it. These are the same justifications submitted to the Chrome Web Store review team.

Permission	Justification
`storage`	Persists the user's own settings (API endpoint, language, anonymization mode, context type) and their credentials — an API key or OAuth access/refresh token. Without it the user would have to re-enter the endpoint and re-authenticate on every single page load.
`host: chatgpt.com`	The content script injects the anonymize/restore toolbar next to the prompt box and reads that field's value when the user clicks a button. This is the only site-level access needed on ChatGPT.
`host: claude.ai`	Same as above, for Claude.ai.
`host: gemini.google.com`	Same as above, for Gemini.
`optional host: the user's API endpoint`	Pseudora can be self-hosted, so the API origin is not known at build time — the user types it into the popup. The extension requests access to exactly that origin at the moment the user saves or tests the setting, and to nothing else. Declining the prompt simply prevents the settings from being saved.

Permissions we deliberately do not request

tabs — the extension never reads tab URLs, titles or favicons. Opening the OAuth login page uses chrome.tabs.create(), which requires no permission.
activeTab and scripting — the toolbar is injected by a declared content script, so no programmatic injection is needed.
Broad <all_urls> host access — the extension is limited to the three AI sites plus the endpoint the user configures.
cookies, history, webRequest, downloads, clipboardRead — never requested.

Remote code

None. Every line of JavaScript and CSS ships inside the extension package. The content security policy is script-src 'self'; object-src 'self', which blocks remote script execution outright. Network traffic is limited to JSON API calls to the Pseudora endpoint.

Verify it yourself

The extension source is public at github.com/nephilimdie/pii-browser-ext. The zip attached to each release is produced by the repository's own CI workflow from exactly those files, with no minification or bundling step, so the published package can be compared against the source line for line.