Extension internals — v2.4.0
Security & Privacy
Reef for Browsers is designed with privacy and security in mind.
All data processing happens locally on your device.
Nothing is uploaded to external servers.
i
No telemetry, no external APIs.
Reef does not send any page content, search queries, or usage data to external servers.
All indexing, search, and storage happens entirely within your browser.
Data Collection
The extension collects and indexes the following data from pages you visit:
Page Structure
Headings (h1–h6), section text, breadcrumbs, and HTML selectors. Scripts, styles, and noscript tags are stripped before indexing.
Actions & Form Fields
Buttons, links, form inputs, and their labels. Field values may be captured and stored to support fill workflows.
Media
Image alt text, captions, video/audio titles, and transcript availability. Actual media files are not downloaded.
Structured Data
JSON-LD FAQ pages, article metadata, and descriptions parsed from structured markup.
Always excluded: Password inputs, payment fields, SSN fields, and elements matching your configured exclusion selectors.
Data Storage
All data is stored locally using browser storage APIs:
- IndexedDB — Compressed (gzip) search indices, cached page data, and site graphs. Stored under the extension's private origin.
- chrome.storage.local — Settings, query history, popular queries, bookmarks, snippets, and notes. Up to 5MB+ with unlimitedStorage permission.
- Memory — Active tab indexes, spotlight results, and cache (cleared on browser restart).
Permissions
The extension requests the following permissions and their justifications:
- activeTab — Allows temporary access to the active tab to index content and execute user-initiated actions.
- scripting — Allows injection of the content script to extract page content and interact with the DOM.
- storage — Persists search indices, settings, and library data between sessions.
- tabs — Lists open tabs and switches between them for the Spotlight search feature.
- contextMenus — Adds right-click options for bookmarking, saving snippets, and adding notes.
- unlimitedStorage — Allows storing large search indices without the standard 5MB quota.
- host: <all_urls> — Injects content scripts on every website so pages can be indexed when activated by the user.
Privacy Controls
You have full control over what Reef accesses and indexes:
Exclusion Selectors
Define CSS selectors for elements Reef must never index or interact with. For example: .private, #secret-area.
Blocked Domains
Completely disable Reef on specific domains. One domain per line. Useful for banking, healthcare, or internal sites.
Destructive Action Confirmation
Require explicit confirmation before executing actions like delete, remove, checkout, or submit order.
Action Mode
Set to "Navigate Only" to prevent Reef from clicking buttons or typing into fields. Only link navigation is allowed.
How to Remove Your Data
You can permanently delete all data stored by Reef:
Clear Cache
Removes all indexed page data from IndexedDB. Pages will be re-indexed on next visit if requested.
Clear History
Deletes all tracked search queries and popularity data from chrome.storage.local.
Reset to Defaults
Clears all settings, cached data, and library items. This cannot be undone.
Uninstall
Removing the extension from Chrome deletes all stored data including IndexedDB and chrome.storage.local entries.
Security Considerations
Be aware of the following security characteristics:
- DOM Access — Content scripts run in the context of every webpage and can read/modify the DOM.
- Form Values — Input field values may be captured and stored to enable autofill-type workflows.
- Cookie Access — The extension's Agent layer can read cookies via the document API for session snapshots.
- History Access — Tab titles and URLs are read to build the cross-tab search index.
- Local Storage — The extension can read localStorage and make snapshots for session restoration.
- History API Override — The extension overrides history.pushState/replaceState to observe route changes.
- Cross-Origin Context — Content scripts inherit the origin of the page they run on within the extension's isolated world.
Data Retention
- Indexed Cache — Cached pages persist indefinitely until manually cleared or overwritten by newer versions.
- Query History — Last 100 unique queries are retained for suggestion features.
- Popularity Data — Per-query popularity counts are retained persistently.
- Library Items — Bookmarks, snippets, notes, and recents persist until manually deleted.
- Settings — Persist indefinitely in chrome.storage.local.