Extension permissions

Chrome permissions describe which browser APIs an extension may call. They do not by themselves say that every accessible value is stored or sent elsewhere, so this reference pairs the manifest with behavior observed in this version.

Permission overview

Permission	Product task	Data involved	Destination or persistence
tabs	List, search, activate, move, group, and close tabs	Open-tab URLs, titles, favicons, state, and position	Processed in the extension; selected fields also appear in local history and sessions
windows	Focus, merge, create, and restore windows	Window membership, position, size, state, and focus	Processed in the extension; captured in sessions
tabGroups	Read, create, update, and collapse native groups	Group title, color, membership, and collapsed state	Applied to Chrome Tab Groups; captured in sessions
storage	Keep settings, usage history, assignments, and recent sessions	Preferences, counters, group data, and complete recent sessions	Chrome local or sync storage, depending on the field
system.display	Map saved windows to display work areas	Display bounds, work areas, and metadata	Captured in session objects and files
alarms	Schedule badge sync and assignment cleanup	Schedule identifiers and timing	Browser alarm scheduling; no direct page-content access
sidePanel	Open Tab Organizer in Chrome's Side Panel when that host is selected	Same interface data as the popup	Presentation in the Side Panel; no extra network access

The manifest has no content scripts. It declares one host permission, https://votes.taborganizer.app/*. That host is not a landing-page feature; the related optional backend path ships disabled. Tab access still exposes sensitive current-browser data through the tabs API, which is why the scope should be evaluated directly rather than inferred from host permissions alone.

Tab access

The tabs, windows, and tabGroups permissions work together:

• grouping reads a tab's domain and page title, then assigns unpinned tabs;
• search matches displayed open tabs and activates the selected tab;
• multi-window tools move tabs and focus or merge windows;
• cleanup closes only tabs included in a confirmed action; and
• session capture records tab, group, and window structure.

system.display supplements session capture and restore with monitor geometry. It does not grant access to screen pixels.

Storage access

Observed examples in chrome.storage.local include:

• tab access counts and last-access timestamps;
• domain-to-group assignments;
• language, theme, filter, view, sync, and Auto-Collapse settings; and
• up to five complete Recent Sessions.

Local extension storage persists beyond the current popup session and can be removed when extension data is cleared or the extension is uninstalled. Do not use it as your only backup.

Sync access

This version uses chrome.storage.sync for custom group names, group colors and gradients, the group taxonomy including any extra domains you assign, your grouping rules, your context profiles and the active profile, and the oversized-group split settings. Grouping rules and extra domains can contain the names of sites you visit. Chrome, rather than the Tab Organizer website, operates that sync mechanism under the active Chrome profile.

Open tabs, tab access counts, domain-to-group assignments, and Recent Sessions are not written to sync storage.

The extension handles quota and storage errors. If Sync Storage Full appears, the attempted custom-group update might not be saved; remove unused groups or shorten names and retry.

Native Tab Groups Sync (BETA) is different from Chrome storage sync:

• Tab Groups Sync (BETA) applies extension assignments to the current browser's native groups.
• Chrome storage sync stores supported custom-group settings through Chrome.

Privacy details

For storage locations and website separation, read Data flows and Extension privacy.

A static review of the delivered package found no bundled analytics SDK. Default operation does not send votes. The package still declares https://votes.taborganizer.app/* for an optional backend path that ships disabled. That observation is version-bound; it is not a claim that Chrome, Chrome Sync, the Web Store, or user-opened external links perform no processing.