Extension privacy and local data

Page access and scanning

The extension reads page structure, styles, accessible names and other content needed for the checks you run. Scan and crawl results are evaluated in Chrome. The scan path does not upload reports to an A11y Scan cloud scanning service. Crawling navigates to websites and makes normal page/network requests, including requests made by those pages.

The packaged extension requests sidepanel, storage, scripting, active-tab, debugger and web-request permissions, with broad website host access. These support page analysis, overlays, saved runs, configured crawl waits and scan orchestration. Opt-in target page simulation attaches Chrome’s debugger only for a viewport scan to set mobile layout, pixel ratio and touch. Chrome displays a debugging banner; close DevTools before using it. The extension clears its overrides and detaches when the run ends. It does not change the user agent or provide physical-device/Safari coverage. Chrome restricts access to some browser and protected pages. Observe mode is currently unavailable.

When you configure an API-response wait in a crawl, the extension observes HTTP(S) request events in the target tab. XHR/fetch URLs and methods are held temporarily in memory to match your configured URL pattern; up to 100 completed response URLs are kept for the active wait. They are cleared after the wait or when the page is reset and are not saved as browsing history. Request and response bodies and headers are not read, and this metadata is not sent to YantraKit.

Current results, workflow captures and saved runs

Active scan results, chat messages and workflow captures live in the extension's current session state. Export a workflow report before closing the sidepanel if you need to keep it. Clearing the current result and deleting a saved run are separate actions.

When you choose Save run, a bounded snapshot is stored in this Chrome profile's local extension storage. It can be used for local comparison after reopening the panel. The store allows up to 20 runs and 5 MB. Saved snapshots omit node HTML and crawl screenshot/HTML artifacts, redact known credential-like URL parameters, and use the public effective configuration. This processing cannot infer every sensitive value in a URL, selector or finding.

Delete saved runs through the run-history controls. Your browser's extension-data controls also govern local storage. Exported files and clipboard copies remain wherever you choose to store or share them.

Optional authenticated crawl and captured artifacts

Authenticated crawling requires explicit local configuration. Login credentials are placed in trusted Chrome session storage for the crawl and cleanup is attempted when the crawl finishes or fails. A cleanup failure is reported. The extension does not include those credentials in public profile exports or the effective config attached to reports.

Logging in to a target website can create that website's own cookies or session. Finishing a crawl does not automatically sign you out of the target website. Use that site's logout controls or your browser's site-data settings when needed.

Screenshots and page HTML are captured only when the corresponding crawl enrichment is enabled. They may include content visible to a signed-in user. Keep reports and captures appropriately private and review them before sharing.

AI conversations

When Chrome's built-in model is available, AI Chat sends that browser API a bounded snapshot of the current selected result and your question. The snapshot includes selected finding identifiers, summaries, rule references, limited selectors, and redacted URLs. It excludes full page HTML, cookies and crawl login credentials. The extension does not call a cloud AI endpoint for this conversation.

Chrome manages model availability and any model download. Starting a new chat drops the prior model conversation; changing the scan or target invalidates its previous context. AI interpretation does not change the scanner's findings. Avoid putting confidential information into a question.

Profiles and exports

Importing a profile from an HTTPS URL contacts that chosen host. The extension omits request credentials, sends no referrer, bounds the response, and rejects redirects. Public profile export removes crawl authentication and mock headers. It does not remove arbitrary secrets from every mock body or other free-text value.

Reports can contain page URLs, selectors, findings and, depending on the report and chosen settings, page snippets or captured artifacts. Downloading, copying, printing, or sharing a report is your choice. Review the complete exported file before sending it to another person or service.

Questions and updates

Use Support for questions or data-handling concerns and current contact availability. Support conversations are handled separately from local scanning. The GitHub tracker is private and requires project access. This factual notice remains noindexed while the operator reviews the final policy and production data flows.