Transparency

Every network request the extension can make

Audited 2026-08-24 against the exact tabonomy-v1.2.1.zip candidate. This is the release engineering inventory behind the store listing and privacy policy; it includes requests made only after an explicit user action as well as automatic setup requests.

External requests

Extension-local fetches

The runtime also uses fetch for packaged resources. These do not leave the extension: the v3 classifier head under models/local-classifier/, the next-action model JSON, ORT WASM/worker assets, and favicon URLs served by Chrome's _favicon endpoint.

Explicitly absent

• No analytics, telemetry upload, ad, crash-reporting, or Tabonomy server.
• No Google Fonts request; fonts and OFL licenses are packaged locally.
• No remote JavaScript, dynamic import from a URL, or remotely hosted worker.
• No chrome.cookies read. Bilibili's one credential-bearing request stays in the user-open page and runs only for explicit transcript export.
• No broad arbitrary-site metadata fetch on a fresh release install; the final manifest has no <all_urls> or optional history grant.

Exact-ZIP enforcement

scripts/package-webstore.sh invokes scripts/audit-webstore-zip.cjs against the completed ZIP. The audit rejects source maps, declarations, retired prototype/Perspective assets and strings, remote-code loaders, permission-grant UI residue, remote fonts, and dormant remote Gemma inference code. Dynamic-code tokens are accepted only at the frozen ORT/Transformers locations and counts, with context anchors for protobuf's dynamic require, webpack bootstrap, ORT embind, and ORT worker importScripts; any token elsewhere fails packaging.

The ten permissions, and what each is for

Release-target manifest inventory (reverify against the exact final ZIP): required permissions are tabs, tabGroups, storage, activeTab, scripting, alarms, offscreen, unlimitedStorage, downloads, and favicon. There are no optional permissions or optional host permissions. Required hosts are huggingface.co (and hf.co), *.youtube.com, *.bilibili.com / api.bilibili.com, and *.hdslb.com.

Required permissions

tabs

Tabonomy's core function is organizing the user's open tabs, which requires reading tab titles and URLs across the window. The classification pipeline reads live tab state to categorize each tab, and the session layer enumerates, closes, and restores tabs for cleanup and Archive recall. Without tabs, no title or URL is visible and nothing can be organized.

tabGroups

Grouping is the primary user action: classified tabs are placed into named, colored Chrome tab groups. Group creation and updates happen both from the toolbar popup's quick actions and from the background classification pipeline. This permission is required to create and manage those groups.

storage

Classified tab metadata, Archive records and cleanup receipts, local diagnostic counters, and opt-in YouTube resume progress are persisted in chrome.storage.local. Non-sensitive preferences such as theme, grouping mode, thresholds, and protective toggles use chrome.storage.sync so Chrome can carry them across the user's signed-in profiles. Retired credentials are removed from both areas. This release does not send collected browsing, progress, or diagnostic data to a Tabonomy server or third-party analytics service.

unlimitedStorage

The on-device classification model (roughly 200 MB) is cached in the Origin Private File System so it survives browser restarts without re-downloading. Together with per-tab embeddings and Archive records, this exceeds the default storage quota; without unlimitedStorage, Chrome could evict the model cache and force repeated multi-hundred-megabyte downloads.

activeTab

Used as a narrow, user-gesture-scoped way to read page metadata from the tab the user is acting on, instead of requesting broad host access. When the user invokes Tabonomy, a small reader is injected into the current tab to extract the title and description that improve classification. This keeps metadata reading scoped to explicit user actions.

scripting

Tabonomy injects small, ephemeral scripts to read page metadata for classification, show an in-page confirmation toast after grouping, and extract page/video text for a direct user-requested transcript or export action. YouTube watch progress runs through the manifest-declared content script, not this permission. Transcript enrichment does not perform automatic page-load or close-time harvesting.

alarms

Manifest V3 service workers are short-lived, so scheduled work must use alarms. Tabonomy uses alarms for periodic classification and maintenance passes and to unload the on-device model from memory after idle periods. Without alarms, this scheduled work cannot run reliably.

offscreen

The classification model cannot run inside a service worker because it needs a WASM/ONNX runtime. Tabonomy runs inference in an offscreen document, created and managed by the background service worker. This offscreen document is what makes fully on-device classification possible.

downloads

Used solely for the user-initiated export feature: when the user chooses to export notes (Markdown / Obsidian), the resulting files are saved to disk via the downloads API. No download occurs without an explicit export action by the user.

favicon

Archive and open-tab rows use Chrome's built-in favicon endpoint to show the site icon for a saved URL. The permission does not expose browsing history; Tabonomy supplies URLs it already holds from its own tab and Archive records.

Host permissions

huggingface.co, *.huggingface.co, hf.co, and *.hf.co

Needed to download the on-device classification model (roughly 200 MB) on first setup and to cache it locally, plus an occasional lightweight reachability check if a model load fails. No user tab data is sent in these requests.

*.youtube.com

Needed for two scoped features: watch-position awareness on eligible pages after explicit per-device consent, and captions/transcript plus basic metadata only after a direct user request. Stored progress lets users see where they left off; Tabonomy does not claim to control YouTube's native resume behavior. Progress is stored in the browser and not sent to a Tabonomy server; automatic transcript harvesting is not permitted.

*.bilibili.com, api.bilibili.com, *.hdslb.com

Needed for a direct user-requested Bilibili transcript export. The video page performs the credential-bearing subtitle-list request in its own page context; the extension receives only a validated, size-bounded track list and fetches allowed Bilibili/HDslb subtitle files without cookies. No session cookie is read or stored by the extension.