Every permission, and exactly what it is for.

The permission list

This list mirrors the extension’s manifest one to one. If a future release needs a new permission, this page changes in the same commit that adds it — that is a mechanical rule in the project’s own build discipline, not a promise about intent.

activeTab

Grants temporary access to the single tab you explicitly invoked capture on. Naoya never captures a tab you did not directly act on, and never asks for the broader, always-on host permission.

scripting

MV3 removes persistent content scripts declared for every page load. This lets the service worker inject the measurement, scroll and fixed-chrome script into the active tab only when a capture actually starts.

downloads

Saves the finished export — PNG, JPEG or PDF — to your Downloads folder once a capture completes. No other use of the Downloads API is made.

storage

chrome.storage.local holds your preferences (default format, quality, filename template). It is never used to store captures — those live in IndexedDB, which needs no manifest permission.

offscreen

The stitch-and-encode step needs OffscreenCanvas, which does not exist inside a service worker. This lets Naoya create a short-lived offscreen document to host that step, on your device.

Five is also close to the floor of what a Chrome extension can ship with, not a starting point padded out later. There is no broad, always-on host permission in that list — the kind that would let an extension read every page you visit whether or not you ever click it. activeTab grants access only to the one tab you explicitly invoked capture on, for that invocation; the extension has no standing access to anything else, on any other tab, at any other time.

What happens during a capture, step by step

“Local-first” is an architecture here, not a slogan — this is the actual sequence of components a click on the toolbar icon runs through.

The popup mounts and immediately asks the service worker to start (or reattach to) a run for the active tab — the activeTab permission is what makes that one tab reachable at all. The service worker owns the run from there: it uses scripting to inject a short-lived script into that active tab, which measures the page, scrolls it, and hides fixed or sticky chrome for each tile. Those tiles are handed to an offscreen document — created with the offscreen permission, because stitching and encoding need an OffscreenCanvas, an API a service worker does not have — which composes them into one bitmap. The result is written to IndexedDB, which needs no manifest permission at all, and from there either rendered as your capture history or, if you asked to save it, written to disk with the downloads permission.

None of those six hops crosses the network. The diagram above draws every one of them, and the crossed-out icon has no arrow reaching it for a reason: nothing in this sequence is a network call.

Zero network requests, checked automatically

The core guarantee behind this page is simple to state and hard to fake: while a capture is running, the extension makes no network request of any kind — no upload, no analytics call, no crash report, nothing. That is not a claim you have to take on faith: a single grep — grep -rnE "\b(fetch|XMLHttpRequest|sendBeacon|WebSocket|EventSource)\b" run against packages/capture/src, packages/stitcher/src and packages/exporters/src — is the entire verification, and it returns nothing: the packages that scroll the page, capture tiles, stitch and export the image contain no networking primitive at all.

This is what “local-first” means here, precisely: your capture is produced, stitched and saved entirely on your machine. There is no account to create, no server that could be breached, and no third party who ever sees the page you captured.

What this does not claim

Naoya does not describe itself as “anonymous” or “encrypted” — those are claims about a system that talks to a server, and Naoya’s capture path has none to encrypt traffic to. The guarantee is narrower and, we think, more useful: nothing leaves your device in the first place. There is nothing in transit to intercept, because nothing is ever sent.

Your capture history — the images and PDFs you have produced — is stored locally in your browser, not in this extension’s cloud, because there is no cloud. Deleting a capture from the history removes it from your device; there is no remote copy to also delete, because none was ever made.