Documentation

Chrome extension permissions, explained

When you install the PromptDC Chrome extension, Chrome shows a list of permissions. This page explains, in plain language, every permission the extension actually declares and why it needs it — straight from the extension manifest.

The short version: PromptDC only sends text to be rewritten when you explicitly ask it to. It does not read your browsing history or log your keystrokes.

Permissions

storage

Saves your profiles, per-website rules, chosen mode, and Lifetime API key locally in the browser. Signed-in profile preferences can sync, but API keys remain local and never sync through PromptDC.

tabs

Lets PromptDC see the address of the tab you're on so it can pick the right mode and profile for that site — for example, defaulting to Code mode on coding platforms. It does not read your browsing history.

sidePanel

Powers the PromptDC side panel, where you manage profiles, per-website rules, and settings without leaving the page you're working on.

identity

Used only for Google sign-in so your account and settings can sync across the extension and the web app. The OAuth scopes requested are the standard openid, email, and profile.

alarms

Schedules lightweight background tasks — such as periodically syncing your settings and refreshing your session — without keeping the extension running all the time.

scripting

Lets PromptDC inject its toolbar and enhance UI into the page when you use it, so the rewrite can happen right inside the text box you're typing in.

contextMenus

Adds the right-click "Enhance with PromptDC" menu item — a quick alternative to the toolbar for enhancing selected text on any site, including pages where you've turned the toolbar off.

Keyboard shortcut

The extension registers one command: Enhance the focused text field, bound to Ctrl+Shift+Space (Cmd+Shift+Space on Mac). It runs only when you press it, and only on the field you have focused.

Site access (host permissions)

PromptDC's backend and settings sync run over these two hosts:

promptdc.com*.supabase.co

The remaining host permissions are the first-class platforms PromptDC ships pre-tuned. Coding sites default to Code mode. The floating toolbar itself works in text boxes on any website; these are the sites it comes pre-configured for:

chatgpt.comclaude.aigemini.google.comgrok.comaistudio.google.commail.google.com (Gmail)linkedin.comx.comtwitter.comreddit.comweb.whatsapp.comlovable.devbolt.newreplit.comcursor.comvscode.devgithub.devv0.devv0.appbase44.commanus.imdevin.airork.comsoftgen.airosebud.aitempo.newapp.tempo.buildsame.newpageai.proclacky.aiorchids.approcket.newleap.newgetmocha.comapp.emergent.shpolymet.aiapp.polymet.aiaura.buildvibecodeapp.comdatabutton.comfloot.comanything.com

The content script is allowed to load on any page so the floating toolbar, right-click menu, and keyboard-shortcut enhance work everywhere — but it only acts, and only sends text, when you explicitly trigger an enhancement. You can turn the toolbar off per site, and it stays off there until you re-enable it. See the full list of supported sites in Supported sites & tools.

What data is sent, and when

Only on an explicit enhance. When you click enhance, use the right-click menu, or press the shortcut, PromptDC sends the text you're enhancing through its backend to be rewritten, then returns the result to your text box. Nothing is sent until you trigger it.

Profiles and rules sync. If you are signed in, your profiles and per-website rules sync through PromptDC's backend. API keys do not sync and must be saved locally in each client.

Bring your own key (BYOK). On the Lifetime plan your provider API key is stored in your browser's local storage and the extension's storage — not persisted on our servers. On each enhancement it transits PromptDC's backend to your chosen provider (OpenAI, Claude, Gemini, or Grok) for that single request. See API key management and the Privacy Policy.

Permission FAQs.

Does PromptDC read everything I type?

No. PromptDC only sends text to be rewritten when you explicitly ask it to — by clicking the enhance button, choosing the right-click "Enhance with PromptDC" menu, or pressing the keyboard shortcut (Ctrl+Shift+Space / Cmd+Shift+Space). It does not stream or log your keystrokes.

Why does the extension list access to so many sites?

The content script loads on any page so the floating toolbar is available in text boxes everywhere. The host_permissions list covers popular sites with tuned defaults, plus promptdc.com and Supabase for the backend and settings sync. Coding sites default to Code mode. Text only leaves the page when you explicitly trigger an enhancement, and you can turn the toolbar off per site.

What happens to my API key with BYOK?

On the Lifetime plan your provider API key is stored in your browser's local storage and the extension's storage — not persisted on our servers. When you run an enhancement, the key is sent through PromptDC's backend to your chosen provider (OpenAI, Claude, Gemini, or Grok) to make that single request.

Can I turn PromptDC off on a specific site?

Yes. You can disable PromptDC per site, and that choice is remembered — it stays off on that site until you turn it back on.