DOCUMENTATION
Extension permissions
Which permissions KomaLens requests, what each one is for and when it asks.
KomaLens only asks for the permissions it needs and, when it can, asks for them at the moment they're needed, one at a time. This is how they appear in the browser and what they're for:
Always-on permissions
Granted when you install the extension.
| Permission | What KomaLens uses it for |
|---|---|
activeTab | Capturing the tab you're on after you click the KomaLens icon. It's temporary: it only lasts for that tab and that moment. |
scripting | Showing the selection box over the page and capturing the area you choose. |
storage | Saving your settings, API key and word list on your device. |
sidePanel | Showing the side panel with the results. |
KomaLens doesn't read the page's code or its content in the background: it only captures the area you select, when you ask it to.
Optional site permissions
The extension also declares optional site permissions (optional_host_permissions) for https://*/*, http://localhost/* and http://127.0.0.1/*. Being declared doesn't mean they're granted: the browser asks you each time, and only for one specific site. They're requested in three cases:
- The site you're reading, when you click Allow on this site because the browser wouldn't let it capture the tab. It's requested for that site only, for example
https://example.com/*. See Troubleshooting. - Your AI provider's domain, when you set it up for Hybrid or Image to API. It's requested for that domain only, for example
https://openrouter.ai/*. localhost/127.0.0.1, when you connect a local model like Ollama or LM Studio.
If you decline any of them, everything else keeps working. For example, without the provider permission you can still use local mode, and without site permissions you can scan by clicking the KomaLens icon.
Removing a permission
You can review and remove site permissions anytime: open `chrome://extensions` (or `edge://extensions`), go to KomaLens **Details** and check **Site access**.What KomaLens doesn't do
- It has no servers of its own: nothing you capture passes through us.
- It uses no analytics or tracking.
- It needs no account or login.
- It doesn't share your API key: it goes straight from your browser to your provider.
The full details are in the privacy policy.