Chrome Extension Permission Information

This page is based on the shipped Chrome Web Store package for extension ID algadbfmljcppohmcckpdemkjklapibd, version 1.0.29. The manifest declares three permissions, two host permissions, and no optional permissions.

Declared permissions

Chrome extension permissions
Permission	Why it is used
tabs	Opens the LinkedIn sign-in and help pages, watches the sign-in tab for completion, finds the active tab, and closes the temporary sign-in tab.
storage	Stores the Content Swarm session ID, CSRF token, selected swarm, cached user details, and PostHog analytics state in Chrome local storage.
cookies	Supports the Content Swarm authenticated session and is used by the logout flow to remove Content Swarm session cookies.
https://www.linkedin.com/*	Runs the Content Swarm controls on LinkedIn. It can read and change page content on linkedin.com. The current code uses this to find visible posts and comment boxes, read post text and post links, insert generated text, and add the Add to Swarm control.
https://api.contentswarm.io/*	Calls the Content Swarm API and runs the sign-in completion parser that saves the session ID and CSRF token from the completion URL.

What the extension can see on LinkedIn

Visible post text and LinkedIn post URLs used by the requested feature.
Comment boxes and the generated comment selected by the user.
LinkedIn page structure needed to insert Content Swarm controls.
The host permission covers all linkedin.com pages even though the current code targets feed, post, comment, and login workflows.

The extension does not declare permissions for browsing history, camera, microphone, location, downloads, or all websites. It declares no optional permissions. The Add to Swarm code reads the copied LinkedIn post link from the clipboard after a user action but does not declare a separate clipboard permission.

What is sent and where

Chrome extension data flows
Action	Data	Destination
Generate a comment	Visible LinkedIn post text, selected tone and length, optional example comment, and a request for five variants.	Content Swarm API. The backend sends the AI prompt and input to OpenAI. Usage events go to PostHog.
Select or post a generated comment	Selected comment, selected swarm, edit and click events.	Comment text and team are recorded by Content Swarm when the native LinkedIn post button is clicked. Product analytics go to PostHog. LinkedIn receives the comment through its own page when the user clicks its button.
Add to Swarm	LinkedIn post URL and selected swarm.	Content Swarm API. The extension also sends product usage events to PostHog.
Sign in and choose a swarm	Session and CSRF tokens, user ID, email, first and last name, and swarm IDs and names.	Session data is used with the Content Swarm API. User identity and product events are sent to PostHog.

What stays local

Chrome local storage holds the session ID, CSRF token, selected swarm, cached user details, and PostHog persistence state. Generated suggestions are held in extension or LinkedIn page memory while the user reviews them. A copied post link is held temporarily before it is sent after Add to Swarm confirmation.

Signing out removes the stored session ID, CSRF token, and selected swarm. The current logout code does not explicitly remove cached user details or all PostHog local state.

Chrome Web Store disclosure

The store listing currently states that the developer will not collect or use data. The shipped code sends account, content, session, and usage data as described above. The store owner should update the Chrome Web Store privacy disclosure so it matches the product.

Related information

See the Privacy Policy, AI Provider Information, Retention and Deletion, and Subprocessor Information.

Content Swarm Limited, 727-729 High Road, London N12 0BP, United Kingdom. Contact support@contentswarm.io.