Browser permissions, explained

Why it asks for access to specific sites

An extension that draws buttons inside a page needs a content script, and a content script needs host access to the pages it runs on. Emojery requests one https://<host>/* entry per supported host, plus https://api.emojery.app/* so it can talk to its own API and https://emojery.app/* for our own site (what it does there).

Chrome, Edge, and Firefox all phrase host access as the ability to “read and change your data” on the listed sites. The wording is the browser's own, never ours, and it appears for every extension that has a content script. What the script actually does on those sites: it finds the action row of a public post, mounts the reaction button next to it, and derives the public identifier the reaction will attach to.

Each site's content script is also declared statically for that site's hosts only. The Reddit script cannot run on GitHub, and none of them can run on a site that is not in the list below.

Two settings you can turn on use that same access to touch the site's own controls, on the page you are looking at and under your own account: Hide original buttons takes the native control out of view, and Auto-press original buttons links the emoji you pick to the site's own reaction or vote. Auto-press is off until you turn it on, one pick presses at most one control, and removing your reaction releases only what the extension pressed. How auto-press works.

Which sites it can run on

Every host the reaction pipeline runs on, exactly as the manifest lists it. 2 non-platform entries sit alongside them: our API, and our own site (both below). Every platform name links to a page showing what the extension does there.

Apart from the 2 entries below, it runs nowhere else. A host that is not in the manifest is a host the browser will never inject the extension into.

The 2 entries that are not a platform

• https://api.emojery.app/*: our own API. No content script runs there; the entry exists so the extension's background worker may call the endpoints that serve counts and accept reactions.
• https://emojery.app/*: our own site, and the only place besides the supported platforms where a content script runs. It does exactly 2 things, both on our pages only: it writes the installed extension version onto the page, so the site can say “already installed” instead of offering you the store link again; and that same marker lets a /react link hand a target to the extension. It reads no page content and sends nothing anywhere. It runs at document_start so the marker is there before our page looks for it.

What it does not read

• Page content, beyond the minimum. The script reads the page's structure only to find where the reaction button belongs and to derive the public identifier of the post, repo, video, or product. It does not scrape, index, or store what you read.
• Private messages, passwords, or form fields. Nothing you type on a page is read or transmitted.
• Private repositories. On GitHub and GitLab the picker does not show and does not react on private or internal repositories and projects: a reaction can only exist for a target the public can reach.
• Your browsing. Nothing is stored about pages you did not react on, and there is no tracking, advertising, or analytics library inside the extension. The count lookup described below is the one request a page you merely view produces, and it leaves nothing behind.

When a URL leaves your browser

Sometimes. Here is exactly when.

1. Showing counts. As supported items scroll into view, the extension asks the API for each one's reaction count, whether or not you react to it. The request contains only a canonical target key, such as youtube/<video-id>, and needs no account; the server answers it without storing or logging the key. While you are signed in, a second request asks which of those items you already reacted to, carrying your session token and up to 50 keys at a time, and is likewise not stored.
2. Reacting. When you pick an emoji, the request carries a canonical URL that the extension reconstructs from the identifier, with query strings and tracking parameters dropped. It sends https://www.youtube.com/watch?v=<id>, never the raw address from your address bar, along with the emoji, a timestamp, your session token, and the random installation identifier described in the privacy policy. On X and Threads the canonical URL includes the author's handle, because every permalink there does; the server keeps the derived key, not the URL.
3. Signing in. The extension opens your provider's own sign-in page in a window and, when the provider hands back a short-lived code, sends that code to 1 endpoint in exchange for a session token. Your provider password never reaches the extension. What the server keeps afterwards is covered in the privacy policy.
4. Reaction context. If the “Community insights” setting is on, which it is unless you turned it off, a reaction also carries your language, and the server attaches the country and city of your connection, your browser family and your operating system. Turn the setting off and those fields stay empty.
5. Bug reports. The Report tab sends the page address, its host, the site it belongs to, how many targets were found on it, and your note, only when you press submit. With “Community insights” on it also attaches the extension version and your browser's raw user-agent string, so a layout bug can be reproduced on the same build; see what we collect.

Nothing above happens on unsupported sites, because the extension is not there.

What stays on your device

• Your reaction history: the popup's History list, kept in full on your device (this is what unlimitedStorage is for) and never uploaded.
• Your own-reactions map: which emoji you picked where, so the button can highlight your choice instantly.
• A short-lived count cache: about a minute, so repeated views don't re-ask the API.
• Your session token after sign-in.
• What this device calls each account: the emoji mark and name shown in the popup, and the settings that account changed away from the defaults, so two accounts on one browser keep their own. Names and marks are chosen here, not by the provider.
• The offline queue of reactions waiting to be sent.

Settings (the master switch, per-site toggles, animation and analytics preferences) sync through your browser's own extension-settings sync and never through our servers.

Turn it off on any site

Click the toolbar icon and open the Settings tab. Turning on Only selected sites gives every supported site its own toggle, and the master Enabled switch turns the extension off everywhere at once. All sites are on by default.

Your browser adds a layer of its own: Chrome and Edge let you restrict any extension's site access from the extensions menu, and Firefox does the same from the add-on's settings.

Delete your account any time

Open the popup's Account tab and choose Delete account. The extension shows a warning and asks you to slide to confirm, so a stray click cannot wipe anything. Deletion erases your account record, reverses every counter you previously contributed to, and clears the local history and session. Your entries in the public log stay, pseudonymous as they always were, each with a public revocation appended after it. It is immediate and irreversible; the details are in the privacy policy. Removing the extension is a separate step, and it leaves the account alone.

What the install prompt asks for

Browsers generate the install dialog themselves from the manifest, so every extension with a content script produces a similar warning. For Emojery the dialog lists exactly the domains from the table above plus our API and our own site, and nothing else.