Extension privacy

The Display browser extension reads the active page only after you open the extension on that page.

What the extension reads

The extension reads the rendered content of the active HTTP or HTTPS page so you can select text, preview a capture, and publish it. The capture includes the page origin and path plus its title. It omits the URL query and fragment.

When you open the Publish dialog, the extension scrolls through a bounded part of the active page to load deferred content, then returns to your original position before capture. The website may make requests or change what it displays in response to that scrolling. The extension does not click or submit page controls.

The extension does not run scheduled captures, crawl other tabs, or keep an ongoing browsing history. It does not run on Chrome settings, the Chrome Web Store, or other protected pages.

What is sent to Display

Preview remains in an extension-owned sandbox. The page capture, optional comments, and any specific-recipient email addresses you add in the earlier publishing flow are sent to Display only after you choose Publish. Recipient addresses stay in the current page session before publishing and are not written to extension recovery or salvage storage.

The capture removes URL query parameters, HTTP subresources, form and authentication values, authored scripts, frames, and unsupported active content. It can include eligible loaded public images, stylesheets, and fonts in the published HTML. It can also copy pixels from eligible images or video frames already loaded on the page. Canvas content and unsupported visuals become measured placeholders.

In a Spaces-enabled organization, the dialog retrieves available destinations and their inherited access from Display. The destination and access details are visible inside the extension. The source page does not receive them. The published document and comments follow the selected location’s access. In the earlier publishing flow, people whose email addresses you add receive a one-time notification with a link to the artifact. Submitted recipient addresses remain in the artifact's access settings until they are removed or the artifact is deleted. Display retains the artifact and comments until the artifact is deleted under the existing account and retention controls.

What is stored in Chrome

The extension stores your Display OAuth refresh token in extension-only local storage. It stores bounded publish recovery data and unfinished comment text in browser-session storage. Browser-session data clears when Chrome exits.

Disconnecting the extension removes its local OAuth credential and browser-session recovery data. OAuth tokens are never exposed to the page.

Requests to other hosts

When you select Preview page or Publish, Chrome may ask you to allow access to the exact hosts serving eligible images and styles on the active page. You can deny the request and continue with a capture that may omit those assets. Chrome manages any permission you grant in the extension's site access settings.

The extension can request bounded copies of eligible images, stylesheets, and fonts used by the selected page. Those requests send no page credentials or referrer and follow no redirect. The asset hosts can observe your IP address and request time. A selected asset URL can itself contain a temporary access token; if you grant permission, the extension may request that exact URL. The query is removed from the captured HTML. The extension does not scan other tabs or search the site for unrelated resources.

A capture can retain query-free public HTTPS resources. Your browser requests those resources from their original hosts when you open Preview, and a viewer's browser requests them when the published artifact is opened. Those hosts can observe the requester's IP address and request time.

How the data is used and shared

Display uses page content, source identity, comments, specific-recipient email addresses, and authentication information only to provide and secure the extension's preview, publishing, sharing, comment, and recovery workflows. This data is not sold, used for advertising, used to determine creditworthiness, or transferred for a purpose unrelated to the extension.

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The Display Privacy Policy explains the service's account data, service providers, retention, security, and privacy rights. Contact privacy@display.dev with a privacy question.