Privacy policy: OpenFullPage

The extension

OpenFullPage collects nothing:

No personal information, no account and no sign in. There is nothing to sign into.
No analytics, no telemetry, no crash reporting and no unique identifier of any kind.
No browsing history, no page content and no cookies.
No advertising, and no third party service inside the extension.

This is not a policy decision that a later release could quietly reverse. It is a property of how the extension is built, and the section after next is the part worth reading.

What happens to your screenshots

A capture is assembled in your browser's own memory and written only where you put it: your downloads folder, as PNG, JPEG, WebP or PDF, or your clipboard. It is never uploaded, and nobody but you ever sees it.

The Upload button is a hand off, not an upload. It copies the image to your clipboard and opens the image host you picked in a new tab, so that you can paste it there yourself. The extension performs no upload and could not perform one: connect-src 'none' blocks every outbound request it could make. What you then paste, and to whom, is between you and that host, under their policy rather than this one.

Why you do not have to take this on trust

Every extension in this category makes a version of the claim above. The difference here is that each line of it is enforced by something other than our good intentions, and checked automatically on every change to the source.

It cannot open a network connection The content security policy declares connect-src 'none', and Chrome itself refuses the request. No setting and no update loosens this without the change being visible in the manifest. manifest.json, asserted by test/invariants.test.js
It holds no access to the sites you visit It can read one tab, at the moment you click its button on that tab, and no other. Broader access exists only as an option you switch on yourself and can revoke. activeTab, rather than host permissions
It stores only your own settings, on your own computer The synced storage area, which would copy your configuration to Google's servers, is banned outright. chrome.storage.local only; chrome.storage.sync fails the build
It cannot fetch or generate code at runtime No eval, no new Function, no update server of its own, and no remotely fetched configuration or lists. scanned on every commit, with a deliberately poisoned fixture proving the scanner fires

You can also confirm that the code running in your browser is the code published in the repository, because there is no build step between them. How to check that takes about five minutes.

Permissions, and what each is for

Permission	When	What it is for
`activeTab`	At install	Read the one tab you clicked the button on, in order to photograph it. It grants nothing until that click and lapses when you navigate away.
`scripting`	At install	Measure the page, load what is below the fold, hold sticky and fixed elements still so they do not repeat down the image, and put the page back afterwards.
`storage`	At install	Remember your settings on this computer. Local storage only, never the synced kind.
`downloads`	On first save	Write the finished image to your downloads folder. Asked for when you first press Download, not at install. Decline it and everything else still works.
`webNavigation` and site access	Optional, off	Capture the full contents of cross origin frames rather than only the part on screen. Off unless you turn it on in settings, and revocable at any time.

Even with every one of these granted, the extension still cannot transmit anything. The permissions let it read a page. None of them lets it send what it read anywhere.

This website

The extension and the website are different things, and it would be dishonest to let the first one's guarantees imply anything about the second. This site sets no cookies, runs no analytics, and has no advertising or tracking pixels. Every font, image and stylesheet is served from this site itself, so a page here makes no request to anybody else. One thing is still worth naming:

Hosting. The site is served by GitHub Pages. Like any web host, GitHub receives the ordinary request information a browser sends, including your IP address, and handles it under GitHub's privacy statement. We have no access to those logs.
The theme switch remembers your choice of light or dark in your own browser's local storage. It never leaves your machine, and choosing System removes it.

None of this applies to the extension, which makes no requests at all, to this site or anywhere else.

The support form

The support page has a form, and a form by definition sends something somewhere. Here is exactly what it sends and where it goes.

What is sent. Your name, your email address, the kind of message you picked, the version if you gave one, and what you wrote. Nothing else. There is no hidden field carrying your browser details, no page history and no identifier.
Where it goes. To a small endpoint of ours running on Cloudflare Workers, which turns it into an email to support@palworks.ai and sends it through Resend, our email provider. Your address is set as the reply address so that a person can answer you.
What is stored there. Nothing about you. The endpoint relays the message and forgets it. It keeps two counters and nothing else: one held against a one way hash of your IP address for one hour, which exists only to stop somebody using the form to send thousands of emails, and one monthly tally of how many emails have been sent, which is a single number and holds nothing about anybody.
What we keep. The email itself, in the support mailbox, for as long as it takes to answer you and to remember why a change was made. Ask us to delete it and we will.
What it is never used for. Marketing. There is no mailing list to add you to, no newsletter, and nothing to sell you.

If you would rather not use the form, write to support@palworks.ai directly, or open an issue on the repository.

Children

OpenFullPage is a general purpose tool and is not directed at children. It collects nothing from anyone, of any age, so there is no children's data for it to hold.

Changes to this policy

If this policy ever changes, and it should not need to, the change will appear in the git history of the repository and in the changelog before any release that contains it. A version of the extension that collected data would need new permissions, and Chrome would prompt you to approve them again.

The wording here is kept in step with docs/PRIVACY.md in the extension's repository, which is the source of truth. The governance document also records a public commitment never to sell or transfer this extension, and a dated canary you can check.

Contact

Questions about this policy, or a request to delete something you have sent us: support@palworks.ai, or the support form. For anything that looks like a security problem, please email rather than opening a public issue.

Privacy policy. Short, because there is nothing to collect.