Security, privacy, and permissions for Grab All Files
Grab All Files scans only the page or URL you choose (including pages you can open with your current login) and asks for site access one site at a time. File discovery, downloads, ZIP creation, CSV export, PDF merging and the Web Page Collector all run locally in your browser.
What is sent to our servers
License verification data and optional pseudonymous usage statistics are sent to the developer's backend. Usage statistics are disabled by default and sent only after explicit consent.
| Purpose | Data sent | Not sent |
|---|---|---|
| License activation and refresh | License key, random device UUID, and license token metadata. | Downloaded files, detected URL lists, source-page contents. |
| Revocation list refresh | No user-identifying payload; the extension downloads a signed revocation list. | License key and file data are not included in this request. |
| Optional usage statistics | After opt-in: random device ID, plan state, event name, and coarse counts or durations. | Page content, URLs, file names, downloaded files, or personal data. |
Site access is requested one site at a time
Installing Grab All Files does not give it access to every website. The only host permission granted at install is our license server; the all-sites patterns (https://*/*, http://*/*) are declared as optional. When you scan a page or save files from a site, your browser asks you to allow that one site. You can review or revoke access at any time: in Chrome or Edge, open Extensions → Grab All Files → Details → Site access; in Firefox, open Add-ons → Grab All Files → Permissions.
| Permission area | Why it is needed | How it is limited in practice |
|---|---|---|
| Read the selected page | Find visible links, embedded files, PDF viewers, and lazy-loaded assets. | Used for pages or URLs the user chooses to scan. |
| Monitor file-like responses | Surface files loaded through fetch/XHR, CMS routes, or viewer endpoints. | Used to build the local result list; the list is not uploaded. |
| Use the current browser session | Download files from portals or member areas that the user can already open manually. | No credential collection; use only where you have permission. |
Every permission and why
| Permission | Why it is needed |
|---|---|
activeTab | Look at the tab where you clicked the extension, only after that click. |
tabs | Know which tab you started from, and open a background tab when the Web Page Collector needs a page as rendered. |
scripting | Find links and files in the pages you choose, including files a page loads by itself, and read the pages you select for the Web Page Collector. |
downloads | Save the files you select, merged PDFs, and the HTML made by the Web Page Collector. |
storage | Keep settings, license status, recent scans and Web Page Collector jobs on your device. |
unlimitedStorage | Store large Web Page Collector jobs (page text and images) on your device without hitting the browser's storage quota. Nothing is uploaded. |
alarms | Run scheduled background tasks: refresh license and revocation status, withdraw temporary site access granted for a download, and continue Web Page Collector jobs. |
notifications | Tell you when a download has finished or failed, and about license status. |
contextMenus | Add right-click actions to scan or download from pages, links, images and selections, and to add pages or links to the Web Page Collector. |
offscreen (Chrome / Edge) | Parse and clean fetched pages and build the HTML file you download, in a hidden local extension page. Nothing is sent anywhere. |
declarativeNetRequestWithHostAccess | Only in the optional strict read-only Collector mode: temporarily block POST, PUT, PATCH and DELETE requests from the collection tab. The rules are removed when the job ends. |
https://*/*, http://*/* (optional) | Declared as optional only: requested one site at a time when you scan or save from that site, and revocable at any time. |
https://umczaaooqinddgnhxbvp.supabase.co/* (license server) | Our license server: license checks, token and revocation-list refresh, device management, and opt-in usage statistics. Never page contents, URLs or files. |
The one request that does not go to a site you chose
To show a file’s size and type, the extension may send an anonymous request (no cookies, no credentials, no referrer) to a small fixed list of well-known public file-storage hosts (such as Amazon S3, Google Cloud Storage, Azure Blob Storage and Cloudflare R2) when a scanned link points to one. These requests never carry your login session, are skipped entirely in session-safe scanning mode, and never go to arbitrary sites.
What stays local
- ✓Detected file lists, filters, and scan results.
- ✓Downloaded file contents.
- ✓PDF merge processing.
- ✓ZIP archive generation.
- ✓CSV export generation.
- ✓Web Page Collector: collected page text, images and the generated HTML (kept in your browser’s IndexedDB; never uploaded).
Check it yourself
- 1Right-click inside the extension window, choose Inspect, and keep the Network tab open while you scan: requests go only to the page you scan and the servers hosting its files, our license server, and, for file sizes, the public storage hosts described above.
- 2Usage statistics stay off until you turn them on yourself.
- 3The store builds contain no analytics or error-reporting SDK (Privacy Policy, section 5a).
Responsible use
Use Grab All Files only for legitimate document collection and workflow automation, and respect the target site terms, copyright rules, access rights, and rate limits.