Browser permissions, explained
Every permission Web Reactions asks for, what the browser's wording actually means, and what the extension can never see. Written for the moment you hesitate over an install prompt.
The three permissions
| Permission | What it grants, in browser terms | What Web Reactions uses it for |
|---|---|---|
storage | Store data in your browser's extension storage | Your settings, your reaction history, and small caches. All of it stays on your device. |
alarms | Wake the extension's background worker on a schedule | Sending queued reactions and refreshing cached counts in short background wake-ups. |
activeTab | See the tab you are on, only when you open the extension | The popup checks the current site so it can show whether it is supported and offer the right per-site toggle. |
What Firefox shows on the install page
Mozilla requires every extension to declare, in a fixed taxonomy, what data it may handle. Those labels appear on the add-on's install page and can sound broader than what actually happens:
- authenticationInfo — the session token you get after signing in with a one-time email code. It authenticates your reactions and nothing else.
- websiteContent — the public identifier of the post, repo, video, or product you react to. The extension reads the page only to find where to mount the button and to derive that identifier.
- personallyIdentifyingInfo — your email address. It is sent only to the two sign-in endpoints that deliver and verify the one-time code; the privacy policy covers how it is discarded.
- technicalAndInteraction (optional) — coarse usage context for aggregate maps. Firefox asks you separately at runtime, and only if you turn on the analytics toggle in settings.
We would rather explain the scary-sounding labels than pretend the extension collects nothing.
Why it asks for access to specific sites
An extension that draws buttons inside a page needs a content script, and a content script needs host access to the pages it runs on. Web Reactions requests one https://<host>/* entry per supported host, plus
https://api.webreactions.app/* so it can talk to its own API.
Chrome, Edge, and Firefox all phrase host access as the ability to “read and change your data” on the listed sites. The wording is the browser's, not ours, and it appears for every extension that has a content script. What the script actually does on those sites: it finds the action row of a public post, mounts the reaction button next to it, and derives the public identifier the reaction will attach to.
Each site's content script is also declared statically for that site's hosts only. The Reddit script cannot run on GitHub, and none of them can run on a site that is not in the list below.
Which sites it can run on
The full list, exactly as it appears in the manifest. Every platform name links to a page showing what the extension does there.
It runs nowhere else. A host that is not in the manifest is a host the browser will never inject the extension into.
What it does not read
- Page content, beyond the minimum. The script reads the page's structure only to find where the reaction button belongs and to derive the public identifier of the post, repo, video, or product. It does not scrape, index, or store what you read.
- Private messages, passwords, or form fields. Nothing you type on a page is read or transmitted.
- Private repositories. On GitHub and GitLab the picker does not show and does not react on private or internal repositories and projects: a reaction can only exist for a target the public can reach.
- Your browsing. Nothing is collected from pages you did not react on, and there is no tracking, advertising, or analytics library inside the extension.
When a URL leaves your browser
The honest answer is: sometimes, and here is exactly when.
- Showing counts. When a supported page loads, the extension asks the API for that target's reaction count. The request contains only a canonical target key, such as
youtube/<video-id>, and needs no account. - Reacting. When you pick an emoji, the request carries a canonical URL that the extension reconstructs from the identifier, with query strings and tracking parameters dropped. It sends
https://www.youtube.com/watch?v=<id>, never the raw address from your address bar, along with the emoji, a timestamp, and your session token. - Signing in. Your email goes only to the two endpoints that send and verify the one-time code. What happens to it afterwards is covered in the privacy policy.
- Optional analytics context. If the “Use my reactions for analytics” setting is on, a reaction may include coarse context for aggregate maps, such as country and language. Turn the setting off and those fields stay empty.
- Bug reports. The Report tab sends the page address and your note only when you press submit.
Nothing above happens on unsupported sites, because the extension is not there.
What stays on your device
- Your reaction history — the popup's History list, capped at 1000 entries and never uploaded.
- Your own-reactions map — which emoji you picked where, so the button can highlight your choice instantly.
- A short-lived count cache — about a minute, so repeated views don't re-ask the API.
- Your session token after sign-in.
- The offline queue of reactions waiting to be sent.
Settings (the master switch, per-site toggles, animation and analytics preferences) sync through your browser's own extension-settings sync, not through our servers.
Turn it off on any site
Click the toolbar icon and open the Settings tab. Every supported site has its own toggle, and the master “Enabled” switch turns the extension off everywhere at once. All sites are on by default.
Your browser adds a layer of its own: Chrome and Edge let you restrict any extension's site access from the extensions menu, and Firefox does the same from the add-on's settings.
Delete your account any time
Open the popup's Account tab and choose Delete account. The extension shows a warning and asks you to slide to confirm, so a stray click cannot wipe anything. Deletion erases your user record, decrements every counter you previously contributed to, and clears the local history and session. It is immediate and irreversible; the details are in the privacy policy.
What the install prompt looks like
Browsers generate the install dialog themselves from the manifest, so every extension with a content script produces a similar warning. For Web Reactions the dialog lists exactly the domains from the section above plus our API, and nothing else.
Common questions
Does Web Reactions read all my browsing?
No. The extension can only run on the nine supported sites listed in its manifest, and it collects nothing from pages you did not react on. There is no all-sites permission to grant.
Why does the install prompt say it can “read and change” my data on these sites?
That is the browser's standard wording for any extension with a content script; it is not specific to Web Reactions. On those sites the script mounts the reaction button and derives the public identifier of the item you react to, nothing more.
Does it see private repos or private messages?
On GitHub and GitLab the picker does not show and does not react on private or internal repositories and projects. Direct messages are not a supported surface on any site, so no picker ever mounts there.
Is my browsing history uploaded?
No. Count lookups send a canonical target key rather than your page URL, and the history list in the popup is stored only on your device, capped at 1000 entries.
Can I limit it to just one or two sites?
Yes. The popup's Settings tab has a toggle per site plus a master switch, and your browser can additionally restrict the extension's site access on its own.
What do the Firefox data-collection labels mean?
They come from Mozilla's fixed taxonomy: authenticationInfo is your session token, websiteContent is the public identifier of what you react to, and personallyIdentifyingInfo is the email used once for sign-in. The optional technicalAndInteraction label covers the opt-in analytics toggle.
Check it for yourself
The manifest is not a promise, it is a public file. Web Reactions is open source under GPL-3.0, and you can read the permission list, or build the extension from source, in the repository.