tabonomy.Transparency
Tabonomy claims there is no server and no telemetry. That is checkable, not assertable: this page lists every network request the extension can make, and every permission it asks for and why.
Every network request the extension can make
Audited 2026-07-20 against the exact tabonomy-v1.0.0.zip candidate. This is the release engineering inventory behind the store listing and privacy policy; it includes requests made only after an explicit user action as well as automatic setup requests.
External requests
| Destination | Trigger | Data sent | Credentials |
|---|---|---|---|
huggingface.co, *.huggingface.co, hf.co, *.hf.co | First local-classifier setup, cache repair, or a connectivity probe after a setup failure | The browser requests public config, tokenizer, and ONNX files for onnx-community/embeddinggemma-300m-ONNX; the failure probe sends a HEAD request to that public model path | No Tabonomy account data or browsing history; standard network metadata still applies |
| The current permitted YouTube or Bilibili page URL | Automatic metadata recovery only when DOM extraction is missing, stale, or unavailable | A bounded HTML request to the page URL already being analyzed | credentials: omit; final manifest limits this fallback to the retained video hosts |
www.youtube.com/oembed | User chooses Save to Obsidian for a YouTube tab | The current YouTube URL as the oEmbed url parameter | credentials: omit |
YouTube caption URLs under youtube.com/api/timedtext | User chooses transcript export for an open YouTube video | Video ID, selected caption language/kind, and the signed caption URL already present in the page player response | Same-site browser behavior applies to the content-script request; no cookies are read or stored by Tabonomy |
api.bilibili.com/x/web-interface/view and /x/tag/archive/tags | User chooses transcript export for a Bilibili video | BVID | Cross-origin extension request; no Bilibili session credential is attached |
api.bilibili.com/x/player/wbi/v2 | Explicit transcript export from the matching open Bilibili video tab | BVID and CID | Runs in that page's MAIN world with credentials: include, so the user's existing Bilibili session may be attached; response is size-capped and sanitized before leaving the page |
Bilibili subtitle CDN on hdslb.com or bilibili.com | Explicit transcript export after a usable subtitle track is selected | The allowlisted subtitle URL returned by Bilibili | Anonymous extension request; subtitle URL is not persisted |
User-configured Obsidian Local REST API endpoint, default https://127.0.0.1:27124 | User tests plugin mode or writes a note through plugin mode | Connection probe, or Markdown note body plus vault-relative path | User-supplied bearer key in the Authorization header; stored locally in chrome.storage.local |
Extension-local fetches
The runtime also uses fetch for packaged resources. These do not leave the extension: the v3 classifier head under models/local-classifier/, the next-action model JSON, ORT WASM/worker assets, and favicon URLs served by Chrome's _favicon endpoint.
Explicitly absent
- No analytics, telemetry upload, ad, crash-reporting, or Tabonomy server.
- No Google Fonts request; fonts and OFL licenses are packaged locally.
- No remote JavaScript, dynamic import from a URL, or remotely hosted worker.
- No
chrome.cookiesread. Bilibili's one credential-bearing request stays in the user-open page and runs only for explicit transcript export. - No broad arbitrary-site metadata fetch on a fresh release install; the final manifest has no
<all_urls>or optional history grant.
Exact-ZIP enforcement
scripts/package-webstore.sh invokes scripts/audit-webstore-zip.cjs against the completed ZIP. The audit rejects source maps, declarations, retired prototype/Perspective assets and strings, remote-code loaders, permission-grant UI residue, remote fonts, and dormant remote Gemma inference code. Dynamic-code tokens are accepted only at the frozen ORT/Transformers locations and counts, with context anchors for protobuf's dynamic require, webpack bootstrap, ORT embind, and ORT worker importScripts; any token elsewhere fails packaging.
The ten permissions, and what each is for
Release-target manifest inventory (reverify against the exact final ZIP): required permissions are tabs, tabGroups, storage, activeTab, scripting, alarms, offscreen, unlimitedStorage, downloads, and favicon. There are no optional permissions or optional host permissions. Required hosts are huggingface.co (and hf.co), *.youtube.com, *.bilibili.com / api.bilibili.com, and *.hdslb.com.
Required permissions
tabs
Tabonomy's core function is organizing the user's open tabs, which requires reading tab titles and URLs across the window. The classification pipeline reads live tab state to categorize each tab, and the session layer enumerates, closes, and restores tabs for cleanup and Archive recall. Without tabs, no title or URL is visible and nothing can be organized.
tabGroups
Grouping is the primary user action: classified tabs are placed into named, colored Chrome tab groups. Group creation and updates happen both from the toolbar popup's quick actions and from the background classification pipeline. This permission is required to create and manage those groups.
storage
Classified tab metadata, Archive records and cleanup receipts, local diagnostic counters, and opt-in YouTube resume progress are persisted in chrome.storage.local. Non-sensitive preferences such as theme, grouping mode, thresholds, and protective toggles use chrome.storage.sync so Chrome can carry them across the user's signed-in profiles. Retired credentials are removed from both areas. This release does not send collected browsing, progress, or diagnostic data to a Tabonomy server or third-party analytics service.
unlimitedStorage
The on-device classification model (roughly 200 MB) is cached in the Origin Private File System so it survives browser restarts without re-downloading. Together with per-tab embeddings and Archive records, this exceeds the default storage quota; without unlimitedStorage, Chrome could evict the model cache and force repeated multi-hundred-megabyte downloads.
activeTab
Used as a narrow, user-gesture-scoped way to read page metadata from the tab the user is acting on, instead of requesting broad host access. When the user invokes Tabonomy, a small reader is injected into the current tab to extract the title and description that improve classification. This keeps metadata reading scoped to explicit user actions.
scripting
Tabonomy injects small, ephemeral scripts to read page metadata for classification, show an in-page confirmation toast after grouping, and extract page/video text for a direct user-requested transcript or export action. YouTube watch progress runs through the manifest-declared content script, not this permission. Transcript enrichment does not perform automatic page-load or close-time harvesting.
alarms
Manifest V3 service workers are short-lived, so scheduled work must use alarms. Tabonomy uses alarms for periodic classification and maintenance passes and to unload the on-device model from memory after idle periods. Without alarms, this scheduled work cannot run reliably.
offscreen
The classification model cannot run inside a service worker because it needs a WASM/ONNX runtime. Tabonomy runs inference in an offscreen document, created and managed by the background service worker. This offscreen document is what makes fully on-device classification possible.
downloads
Used solely for the user-initiated export feature: when the user chooses to export notes (Markdown / Obsidian), the resulting files are saved to disk via the downloads API. No download occurs without an explicit export action by the user.
favicon
Archive and open-tab rows use Chrome's built-in favicon endpoint to show the site icon for a saved URL. The permission does not expose browsing history; Tabonomy supplies URLs it already holds from its own tab and Archive records.
Host permissions
huggingface.co, *.huggingface.co, hf.co, and *.hf.co
Needed to download the on-device classification model (roughly 200 MB) on first setup and to cache it locally, plus an occasional lightweight reachability check if a model load fails. No user tab data is sent in these requests.
*.youtube.com
Needed for two scoped features: watch-position awareness on eligible pages after explicit per-device consent, and captions/transcript plus basic metadata only after a direct user request. Stored progress lets users see where they left off; Tabonomy does not claim to control YouTube's native resume behavior. Progress is stored in the browser and not sent to a Tabonomy server; automatic transcript harvesting is not permitted.
*.bilibili.com, api.bilibili.com, *.hdslb.com
Needed for a direct user-requested Bilibili transcript export. The video page performs the credential-bearing subtitle-list request in its own page context; the extension receives only a validated, size-bounded track list and fetches allowed Bilibili/HDslb subtitle files without cookies. No session cookie is read or stored by the extension.