Gray Hole
权限与联网说明
隐私政策讲的是数据本身：收集什么、存在哪里、保留多久。这一页讲实现：扩展向浏览器申请了哪些权限、每一项对应哪个功能，以及它在什么条件下会发起网络请求。拆成两页是因为这些内容属于技术说明而不是条款——放在一起会让隐私政策变成一份没人读得完的清单。
一、浏览器权限逐条用途
扩展在清单里声明了几项权限，每一项都对应一个具体功能。没有「预留」的权限，也没有申请了却用不到的能力。
| 权限 | 用途 |
|---|---|
storage | 在本地保存设置、登录凭证与短时撤销记录 |
unlimitedStorage | 存放摘录正文与你保存的图片字节。图片单张上限 8 MB、单条摘录最多 8 张，默认配额容易不够 |
contextMenus | 提供「加入 Gray Hole：选中文字」与「加入 Gray Hole：这张图片」两个右键菜单项 |
sidePanel | 把收藏库显示在浏览器侧栏里，不打断你正在读的页面 |
activeTab | 在你主动点击工具栏图标时，读取当前标签页的标题与地址，作为摘录的来源信息 |
clipboardWrite | 把摘录整理成 Markdown 复制到剪贴板，供你粘贴到别处 |
http://*/*https://*/*（内容脚本匹配范围） |
在网页上显示选中浮条。这是核心功能的前提——扩展要在你选中文字的那一刻读到那一段，就必须能访问页面内容。只有你主动选中文字或右键时，它才读取你选中的那一段；在你点保存之前，内容不会写进收藏库，也不会发往任何服务器 |
内容脚本运行在封闭的 Shadow DOM 里，页面自身的脚本拿不到摘录正文；扩展也没有开放任何供页面调用的保存接口。chrome:// 开头的浏览器内部页面不允许扩展注入，我们也就读不到。
安装时 Chrome 会提示「读取和更改你访问的所有网站上的数据」。这条提示来自上面的匹配范围，是摘录类工具绕不开的一项——它精确描述了扩展能够触及的范围，而实际读取范围只限于你主动选中的那一段。
二、完整的联网清单
下面是 Gray Hole 可能发起的全部网络请求。没有别的。
| 场景 | 请求目标 | 触发条件 |
|---|---|---|
| 备份一张图片 | 该图片的原始地址 | 你主动保存了一张图片。请求使用 credentials: omit 与 referrerPolicy: no-referrer，不携带你的登录 Cookie，也不带来源页。图片服务器仍能看到你的 IP |
| 注册 / 登录 / 找回密码 / 同步摘录 | *.supabase.co |
你注册了账号并使用云同步。纯本地使用不会产生这类请求 |
| 浏览本站页面 | grayhole.tech |
你访问官网。本站不加载任何第三方资源 |
| 官网匿名流程统计 | *.supabase.co 的 funnel_events 表（只写入、不可读取） |
你浏览官网页面或点击站内关键按钮时，由官网页面自发一条记录。字段清单与边界见 隐私政策 第五节。浏览器开启「请勿追踪」时不发送。扩展端不存在这一项。 |
三、云同步会写入哪些字段
云同步开启后，下列字段会以整行镜像的方式写入云端，只写给你自己。不开启云同步时，这几张表里没有你的任何数据。
| 表 | 字段 |
|---|---|
clips |
摘录正文与 Markdown 副本、标题、来源信息（平台、厂商、页面标题、页面地址）、定位锚点、所属收藏夹、标签、星标与归档状态、回收站标记、内容类型、内容指纹、图片的链接与元数据、创建与修改时间 |
collections | 收藏夹名称、匹配关键词、创建与修改时间 |
profiles | 用户 ID、显示名、注册时间 |
assets | 图片字节的云端副本。此表已建好但当前版本未启用，图片仍以本地副本保留在你各设备上 |
四、本地存了什么
不注册账号时，下面的内容就是 Gray Hole 的全部数据，它们不离开你的浏览器。
| 内容 | 位置 |
|---|---|
| 摘录正文、标题、标签、收藏夹、来源信息 | 扩展的 IndexedDB，库名 tata-clipper-v1，表 clips |
| 你保存的图片字节 | 同上，表 assets，以 Blob 形式保存 |
| 界面偏好、主题、演示种子标记 | 同上，表 settings |
| 登录凭证（仅在注册后存在） | 扩展：chrome.storage.local；网页：该站点的 localStorage |
五、一个需要你知道的细节：来源地址
来源地址可能包含私密信息。为了让摘录能回到原文，我们保留原始页面地址。如果那个地址里带着会话 ID、查询参数或一次性令牌，它们也会被一起保存下来。这一点在本地和云端都成立。
因此：导出的 JSON 备份、以及云端镜像，都请当作不适合公开分享的内容对待。我们不对这些字段做额外的应用层加密——数据库层的加密由托管方提供。
回到隐私政策
数据的收集范围、存放地区、保留期限与删除方式，见 隐私政策；使用许可与责任约定，见 服务条款。
对本页任何一条有疑问——包括你从 Chrome 应用商店的权限提示里看到的那一条到底对应什么——写信到 [email protected]。
Permissions & network
The Privacy Policy covers the data itself — what we collect, where it lives, how long it is kept. This page covers the implementation: which permissions the extension asks the browser for, what each one is for, and when it makes a network request. They are split because this is technical description rather than contractual terms — merged together, it turns a privacy policy into a list nobody finishes reading.
1. What each browser permission is for
The extension declares a handful of permissions in its manifest, each tied to one concrete feature. There are no reserved permissions, and nothing is requested that isn't used.
| Permission | What it is for |
|---|---|
storage | Keeping settings, your sign-in credentials and short-lived undo records on your machine |
unlimitedStorage | Holding clip text and the bytes of images you save. Individual images are capped at 8 MB and 8 per clip, and the default quota is easy to exceed |
contextMenus | The two right-click items: “Add to Gray Hole: selected text” and “Add to Gray Hole: this image” |
sidePanel | Showing the library in the browser sidebar, so it doesn't interrupt the page you are reading |
activeTab | When you click the toolbar icon deliberately, reading the current tab's title and address to record where the clip came from |
clipboardWrite | Formatting clips as Markdown and copying them to the clipboard so you can paste them elsewhere |
http://*/*https://*/*(content script match patterns) |
Showing the selection bar on web pages. This is the precondition for the core feature — to read the passage the moment you select it, the extension has to be able to reach page content. It reads only the passage you select, and only when you select or right-click it yourself; until you hit save, nothing is written to the library and nothing is sent to any server |
The content script runs inside a closed Shadow DOM, so a page's own scripts cannot reach clip text, and the extension exposes no save API for pages to call. Browser-internal chrome:// pages don't allow extensions to inject at all, so we can't read those either.
Chrome warns at install time that the extension can “read and change all your data on all websites”. That warning follows from the match patterns above and is unavoidable for any clipper — it describes precisely what the extension is able to reach, while what it actually reads is limited to the passage you select yourself.
2. Every network request
Below is the complete list of network requests Gray Hole can make. There are no others.
| When | Request target | Trigger |
|---|---|---|
| Backing up an image | The image's original URL | You deliberately saved an image. The request uses credentials: omit and referrerPolicy: no-referrer, so it carries no login cookie and no referrer. The image server can still see your IP address |
| Sign up / sign in / password reset / clip sync | *.supabase.co |
You registered an account and use cloud sync. Purely local use produces none of these |
| Browsing this site | grayhole.tech |
You visit the website. The site loads no third-party resources |
| Website anonymous funnel events | The funnel_events table on *.supabase.co (write-only, not readable) |
When you open a page on this site or click one of its key buttons, the page writes one row itself. Fields and boundaries are in Section 5 of the Privacy Policy. Nothing is sent when Do Not Track is enabled. The extension has nothing of the kind. |
3. What cloud sync writes
With cloud sync on, the following fields are mirrored to the cloud row by row, written only for you. With cloud sync off, these tables hold nothing of yours at all.
| Table | Fields |
|---|---|
clips |
Clip text and its Markdown copy, title, source information (platform, vendor, page title, page address), position anchors, collection membership, tags, starred and archived state, trash marker, content type, content fingerprint, image links and metadata, creation and modification times |
collections | Collection names, matching keywords, creation and modification times |
profiles | User ID, display name, registration time |
assets | Cloud copies of image bytes. The table exists but is not enabled in the current version; images remain as local copies across your devices |
4. What is stored locally
Without an account, the items below are the entirety of Gray Hole's data, and none of it leaves your browser.
| Content | Location |
|---|---|
| Clip text, titles, tags, collections, source information | The extension's IndexedDB, database tata-clipper-v1, table clips |
| The bytes of images you saved | Same database, table assets, stored as Blobs |
| Interface preferences, theme, demo seed marker | Same database, table settings |
| Access token (exists only after you register) | Extension: chrome.storage.local; website: this site's localStorage |
5. One detail worth knowing: source URLs
Source URLs can contain private information. So that a clip can find its way back to the original page, we keep the page address. If that address carries a session ID, query parameters or a one-time token, those are stored along with it. This is true both locally and in the cloud.
Treat exported JSON backups and the cloud mirror as content that is not safe to share publicly. We do not add application-layer encryption to these fields — encryption at rest is provided by the hosting platform.
Back to the Privacy Policy
For what we collect, where it is stored, how long it is kept and how to delete it, see the Privacy Policy; for licence and liability, see the Terms of Service.
If anything on this page is unclear — including which line here corresponds to the permission warning you saw in the Chrome Web Store — write to [email protected].