Permission justifications

For the Chrome Web Store submission form. One or two sentences each, as asked.

Single purpose

Shows an animated cat on the page occasionally for fun.

storage

Saves the user's own preferences — which kinds of cat they picked, how many turn up, how often they want visits, quiet hours, blocked sites, size and sound — plus a small local record of the extension's own activity: counters, timestamps, the visit times in the past hour that enforce the hourly limit, and the last few error records for diagnosis, scrubbed of any web address — and the latest bulletin file, so the popup can show it without waiting. No browsing data of any kind is stored, and none of it is transmitted unless the user switches on sharing.

alarms

Schedules the next cat visit. A Manifest V3 service worker is shut down whenever Chrome likes, so setTimeout cannot survive; alarms are the only mechanism that can.

scripting

Registers the content script that draws the cat, and injects it into a tab that was already open before the extension was installed. It is never used to read or modify page content.

idle

Checks whether the user has stepped away, so a cat does not perform to an empty chair and does not count against the hourly limit. It reports only active / idle / locked — never what the user is doing.

offscreen

Plays a short synthesised chime. A cat that appears on its own has no user gesture behind it, so Chrome's autoplay policy would block the sound from the page. The offscreen document is closed again once things go quiet, and sound can be switched off entirely.

activeTab

Lets the toolbar bell summon a cat onto the tab the user is looking at, even if they declined full host access. It applies only to that one tab, only after the user clicks.

<all_urls> — host access, declared in the manifest

The extension draws a decorative animated cat on top of the page the user is viewing. It does not read, modify, collect or transmit page content.

It is declared up front rather than requested at runtime because the extension's whole function is to appear on ordinary browsing, and an optional flow only moves Chrome's warning to a moment when the user has already installed and is puzzled about why a cat needs it. Users who want to narrow it can do so under chrome://extensions → Site access, and the extension keeps working on demand via activeTab if they do.

What the access is used for, in full: appending one element to the page, and reading the size of the window to decide where the cat should stand. The extension never reads page text, never touches form fields, never records which sites are visited, and never sends anything about them.

Telemetry endpoint — only when sharing is switched on

Present only in versions that offer usage sharing, and only reachable if the user switches it on. It is one origin, run by us, and it is the sole destination the extension can send anything to — sending is confined to a single file, background/report.js, and gated on both a configured endpoint and explicit consent.

What is sent, weekly and with no identifier of any kind: counts of visits, bell rings and treats, which behaviours ran, which settings were changed from their defaults, the NUMBER of blocked sites (never which), and error records scrubbed of any web address. No page content, no URLs, no hostnames, nothing about typing.

Because <all_urls> is already requested for the extension's actual purpose, this adds no further permission warning at install.

Remote code

None. No remote code is used. Every asset ships in the package: the cats are SVG generated in JavaScript and the sounds are synthesised with the Web Audio API. The one file the extension fetches, the popup's bulletin (https://window-cat.pages.dev/bulletin.json), is JSON data — a line of text and links checked against an allowlist — and is never evaluated as code.