Extension permissions and privacy
What the extension can access and what it keeps.
The extension requests only the Chrome permissions and host access it needs to work, and it keeps as little as possible on your device. This page explains exactly what it has and does.
Permissions it requests
| Permission | Why it is needed |
|---|---|
| storage | To keep its connection token and small run state on your device |
| activeTab | To interact with the tab it is working in |
| scripting | To inject the form-filling logic into supported pages |
| alarms | To keep its background worker responsive during a run |
| declarativeNetRequest | To handle supported-site requests it needs, without touching security headers |
Chrome extension manifest permissions
public/docs/images/docs-extension-permissions.png
Sites it can reach
- internshala.com and its subdomains, to fill and submit applications.
- applivo.in (and www.applivo.in) or the local development origins, to receive approved runs from the website.
What it does not do
- It does not read cookies, copy sessions, or remove site security headers.
- It does not use Native Messaging in this build.
- It has no form fields or secret inputs in its popup; the popup is a status viewer only.
- Its logs contain short status codes, not your answers, email, phone number or tokens.
Where its data lives
- The connection token and minimal run state are stored in Chrome's extension storage on your device.
- The token is scoped to the extension endpoints and can be revoked server-side at any time.
- Advanced profile, billing and account management live only on the website.