Before you install

“Do I really have to install an extension?”

Yes. Emojery draws a reaction button inside the pages you already read, next to each site's own buttons, and only a browser extension can do that. No website or bookmarklet could do the same job.

What we can do is make leaving cheap. Uninstalling takes 2 clicks and removes everything with it, because your reaction history lives only on your device. If you made an account, deleting it from the popup erases your server record and subtracts every reaction you left from the public counters, by appending a public revocation to each of your pseudonymous entries in the append-only log rather than editing them away. Trying Emojery is a fully reversible decision; the exit is as fast as the entrance.

The build you install is not a black box either: store releases go through the stores' own review, the complete source is public under GPL-3.0, and you can build and install it from source if you would rather run a copy you compiled yourself.

Check it: read the source code; what deletion erases is in the privacy policy.

“What permissions does it ask for?”

5 standard ones. storage keeps your settings and reaction history on your device, unlimitedStorage keeps the browser from capping that history, alarms lets the background worker wake briefly to send queued reactions, activeTab lets the popup see which site you are on so it can offer the right per-site toggle, and scripting puts the button on supported pages you already had open when you installed it, so you don't have to reload them.

Site access is limited to the 14 supported sites plus our own API and our own site. For scale: most ad blockers and password managers ask for access to every website you will ever open. Emojery has no such grant — the browser refuses to load it anywhere outside that manifest list, and scripting above reaches no further than it. It requests no tabs, no cookies, no webRequest, and no identity permission.

Check it: the permission-by-permission breakdown, with the exact host list from the manifest, is on Browser permissions. Your browser renders the same list in the install prompt and in its extension settings, straight from the manifest; our copywriting cannot touch it.

“Is it going to read my pages?”

On the 14 supported sites, it reads the page locally for exactly 2 purposes: finding where the reaction button belongs, and deriving the public identifier of the item you react to. That analysis happens in your browser and stays there.

What actually leaves is small and boring. Showing counts sends an anonymous lookup for the public items on your screen. Reacting sends the item's canonical URL, your emoji, and your session token. Nothing you type is read, private pages get no button at all (private repositories, closed accounts), and unsupported sites send nothing because the extension is never loaded there.

Check it: the complete “when a URL leaves” list is published, and your browser's own Network tab shows every request while you react.

“Do I have to sign up?”

Not to look. Reading counts is anonymous and needs no account. Reacting needs one sign-in with a provider you already use so that one account counts as one vote, and that is the entire “registration”: no password, no profile, no email, and the provider learns only that you signed in, never Facebook what you react to.

And the provider id is not kept. It is used once to compute a one-way keyed hash that acts as your account identifier, and that hash is all that remains. The database holds no names, no addresses and no provider ids to read, and a stolen copy of it yields none.

Check it: the one-account-one-vote reasoning is on How sign-in works; everything the server stores is listed under what we collect.

“How do I know it isn't tracking me?”

Start with what is not there. The extension ships no analytics library, no fingerprinting, no tracking cookies, and no advertising SDK. It stores nothing about pages you did not react on, it cannot see sites outside the 14 it supports, your reaction history never leaves your device, and raw IP addresses are not stored (a salted hash is used for rate-limiting only).

There is also no incentive to track you. Emojery has no ads, no data buyers, and no investors; it is a donation-funded open-source project, and tracking you would be a cost, not a revenue line. The one planned source of revenue, a paid API, serves the same aggregate counts the public log already publishes, so it gains nothing from knowing who you are.

One correction, and it cuts the other way: reactions you submit carry your country and city, language, browser family and operating system for aggregate maps, and that setting starts on. One switch in settings turns it off for good, and on Firefox nothing is sent until you separately grant the browser's own data-collection permission.

Check it: the full not-collected list is published, and the source is public.

“Almost nobody is on it yet. Why install?”

Fair, and we will not pretend otherwise: Emojery is in public beta with a small community that gains people every week. You would be early here rather than alone.

First, small numbers here are real numbers. Every count can be recomputed from the public log by anyone, so we could not pad the totals to look busier even if we wanted to — the log would expose us. On the big platforms, big numbers routinely include bots and paid reach.

Second, the extension is useful before any crowd arrives. It counts reactions where platforms hide or removed them, it gives you the full emoji palette instead of a single Like, and it keeps a private local history of everything you reacted to. Return YouTube Dislike started in the same empty room, with the same question hanging over it.

And an early reaction simply matters more: on a young network, each vote is a visible share of the signal instead of a rounding error.

Check it: the trust model behind “real numbers” is on Counts you can trust; the open-source verifier recomputes them in one command.

What it cannot do, by construction

Policies can change and promises can be broken, so this page prefers a stronger currency: things the system cannot do the way it is built. Each one comes with its proof.

• Run outside the hosts in its manifest. The manifest lists the only hosts the browser will inject the extension into: the 14 supported sites and emojery.app. Changing that list takes a store-reviewed release. The exact list.
• Upload your reaction history. It lives in local extension storage, and the API has no endpoint that accepts it. What stays on your device.
• Identify you by name or email. The sign-in never asks your provider for either; only a one-way keyed hash of an opaque provider id remains. What do you store about my account?
• Quietly change public counts. History is an append-only log anchored outside our servers, and the open-source verifier recomputes every total and fails loudly on any mismatch. How verification works.
• Tell anyone what you reacted to. The API serves aggregates; there is no “who reacted” endpoint to query. Can someone tell I reacted?
• Keep your data after you leave. Account deletion erases your record and reverses your reactions out of every counter; uninstalling removes everything local. Your rights.