Privacy and permissions

Version 1.4.4 · 10 October 2026 · Built by Aleyda Solis · Orainti & SEOFOMO

What the extension reads

Only after you invoke the extension and start a scan, it reads the selected current or batch page URL, title, structured product data, selected metadata, policy links, control-label signals, bounded visible price snippets and limited excerpts matching possible AI-directed instruction patterns. It does not intentionally read input field values, passwords, cookies or account tokens. Page markup itself may contain personal or sensitive information; scan public ecommerce pages and review exports before sharing.

Requests made by a scan

The extension makes anonymous GET requests, with credentials omitted, to the same origin for the page HTML, robots.txt, /.well-known/ucp, /.well-known/oauth-authorization-server, a generated missing URL and a limited sitemap sample. Requests reveal your IP address to the scanned site and can appear in its logs. Requests run in an isolated content-script context. Same-origin redirects are followed with browser-enforced same-origin mode; cross-origin redirect destinations are not requested. Cookies are omitted on all hops, and no Referer header is sent. Links to documentation open their respective websites only when you click them.

Optional batch auditing

Users can paste up to 10 URLs and grant optional website access. Only the entered scheme/host patterns are requested; each grant covers all paths and ports for that scheme/host and persists until removed in the batch workspace or Chrome. No mandatory all-site grant is added. Batch pages open in temporary tabs using your existing browser session: normal navigation can send cookies, follow cross-origin redirects and load third-party resources. The extension does not scan a batch page redirected outside its requested origin. These navigation behaviors are separate from the anonymous, same-origin diagnostic fetches described above.

The latest batch summary stores up to 10 requested/observed URLs, timestamps, scan outcomes and bounded automatic finding evidence locally. It remains independently of individual report eviction until replaced or deleted. CSV/JSON exports include this evidence. Keep the workspace open to progress through the queue. Closing it stops subsequent pages; an active scan may still finish. Interrupted scans are not treated as passes.

Optional user-agent comparison

Off by default. Five diagnostic requests use a randomly marked query URL on the current origin without cookies: one normal browser baseline and four requested crawler user-agent strings. The marker and these requests may appear in site logs. Temporary header rules match only the exact diagnostic URL, tab, GET method and fetch/XHR resource type. Ordinary page URLs do not match. A site service worker or other extension may still affect requests. Probe redirects are not followed. Use only on authorized public pages.

Rule removal is retried and verified after each request, on worker initialization and before every scan. A persistent cleanup failure blocks scanning and instructs you to disable the extension until cleanup succeeds. Worker interruption can leave an exact diagnostic-URL rule until recovery. Saved evidence includes summary metadata, diagnostic URL and a hash of inspected product fields; complete bot response bodies are not retained.

Storage and retention

Evidence and manual notes are saved in this Chrome profile using extension local storage. The newest 20 scans are retained, with older scans removed earlier if needed to stay within storage limits. Delete one scan from its report or all saved scans from the popup. No analytics, telemetry, remote fonts or external AI calls are included.

Feed imports and product comparisons

Files you explicitly choose are parsed locally in the report tab. CSV, TSV, flat JSON/JSONL and RSS/Atom XML imports are limited to 5 MiB and 10,000 product rows. The full imported file remains in memory for that tab session and is not persisted. Only your selected normalized product row, column mapping, selected format/number options, field-validation evidence, filename, import timestamp, aggregate ID counts and context notes are saved with the scan. Clearing feed evidence removes that saved row from the scan. No feed data is sent to a server or AI service. Visible product values you confirm are also saved locally. Exports can contain this information.

Sharing

Nothing is automatically sent to the author or an AI provider. Copying or exporting a report creates a user-controlled copy; sending that copy to another service is your choice. Exported reports contain URLs, product data and any notes you saved.

Permissions

• activeTab: temporary access to the tab you explicitly invoke the extension on.
• scripting: read-only collection and document parsing in the selected current-page or batch tab.
• storage: save evidence, scan history, your manual decisions and the bot-check preference.
• declarativeNetRequestWithHostAccess: used only by the optional bot user-agent check, to set the User-Agent header on its own requests in the scanned tab. Access comes from activeTab for current-page scans or optional website grants for batch scans.

No mandatory all-site host access is requested. Optional grants for batch hosts persist until revoked. Request-header rules are limited to an exact diagnostic URL and tab; verified cleanup and failure handling are described above. No shopping actions, purchases or form submissions are performed.

Publisher

AI Shopping & Agentic Commerce Checker is built by Aleyda Solis (Orainti & SEOFOMO). The publisher receives no data from the extension. Contact: through orainti.com.