Privacy

Last updated 16 September 2026

The extension collects nothing. There is no account, no sign in, no analytics, no telemetry, and no server of ours for anything to be sent to. We could not see what you extract even if we wanted to.

It runs on your machine. The extension reads stylesheets in the page you are already looking at, and the server drives a browser locally. Nothing you extract is sent anywhere, unless you set your own AI key, in which case it goes only to the provider you chose.

Everything below is the long version of those two sentences, so you can check them rather than take our word for it.

This website is a separate thing from the extension, and it does use Google Analytics. That is described in full under this website below. Nothing the extension does is reported to it, and no part of what you extract ever reaches it.

What the extension can see

Verbatim has no content script that runs on page load. Nothing is injected into any page until you click the toolbar icon or press the keyboard shortcut. From that moment, on that tab, it reads the page the way your browser's own inspector does: the DOM, the stylesheets, the computed styles, the fonts and the images.

It reads that information to show it to you. It is not recorded, not aggregated, and not transmitted.

What it stores, and where

Five things, all in chrome.storage.local, which lives on your own device and is never synced to us:

Key	What it holds
options	Your settings: colour format, default scope, Tailwind version, whether resets are dropped, and so on.
toolbarPosition	Where you dragged the toolbar, so it reopens there.
windowGeometry	The size and position of the component, clone and asset windows.
options.bridgeToken	The token you paste in to connect the extension to the Verbatim server on your own machine. It is generated by that server and never leaves your device.
options.aiKey	An API key for your own AI provider, if you chose to set one. Empty by default. Sent to that provider as the credential on its own requests, and to nobody else.

Removing the extension removes all of it.

What leaves your browser

Three things, and only these. The third happens only if you ask for it.

Stylesheet requests. A page can load CSS from another domain but is often forbidden from reading it back, which is exactly the information Verbatim needs. So the extension refetches those same stylesheet URLs, with credentials omitted, so no cookie of yours is attached. The request goes to the same server the page already loaded that file from, and nowhere else.
Handoffs to your own machine. If you press G to send a selection to your coding agent, it is posted to 127.0.0.1, the loopback address of the computer you are sitting at. It does not traverse the internet. The server accepts the extension and refuses everything else: Origin is a header a web page is not allowed to set, so a page that probes your local ports cannot pretend to be the extension, read your captures, or plant one.
Your own AI provider, if you give Verbatim a key. There is a setting for an API key from Anthropic, OpenAI, Gemini or OpenRouter. It is empty until you fill it, and while it is empty nothing is sent to anyone. Once it is set, the two buttons that use it send the extraction of the element you picked, its markup and its CSS, to the provider you chose, using your key. That request goes from your browser to them. It does not pass through us, we are not billed for it, and we never see it. Clear the key and it stops.

Screenshots, saved HTML and asset zips are written by Chrome's own download system to your disk. They are built in the browser and never uploaded.

If you add your own AI key

This is the only part of Verbatim that sends anything to a third party, and it is off until you set a key. What it does with it is narrow on purpose.

What is sent: the markup and CSS of the element you picked, and the task you typed if you typed one. Not the whole page, not your browsing, not anything from another tab.
What it is used for: naming classes that a build step turned into hashes, and writing the brief that accompanies the code. It is never allowed to change a value. Every declaration is compared before and after, and an answer that altered one is thrown away.
Who sees it: the provider you chose, under your account, on their terms and their retention policy. Read theirs, because ours does not cover them.
Where the key lives: chrome.storage.local on this machine, alongside your other settings. It is sent to that provider as the request's credential and nowhere else.

If any of that is not a trade you want, leave the field empty. Everything else in Verbatim works exactly the same without it.

This website

verbatim.design, the pages you are reading now, uses two third-party scripts. Google Analytics 4 counts visits and shows which pages people arrive on. Microsoft Clarity records how a page is used: where the cursor moves, what is clicked, how far down people scroll, and it can replay a session as a recording. It is a marketing site, and seeing where somebody gets stuck is how a confusing page gets found and fixed.

Clarity is a session recorder rather than a counter, so it is worth being precise about it. It sees what you do on these pages. It does not capture what you type into a password field, and Microsoft is the processor. If you would rather not be recorded, any content blocker stops it and nothing on this site breaks without it. It runs on these pages only, never in the extension.

The extension opens this site once, and only once: on first install it opens the getting started page in a new tab, which is a normal page view on this domain and is counted like any other. It does not do that on an update, and it sends nothing about you with it. If you were offline when you installed it, it opens a copy bundled inside the extension instead and this site is never contacted at all.

Alongside it there is a small first-party count of our own, written to our own database rather than to anyone else's service. It records that a page was viewed, roughly where from at country and city level, what sent you, and whether you pressed one of the buttons. It does not record your IP address, which Vercel resolves to a country before our code ever runs, and it sets no cookie. The only identifier is a random string held for the length of the browser tab, so three pages read in one sitting are not counted as three people. It cannot be joined to anything, it does not survive the tab closing, and there is nothing in it that could identify you.

The waitlist. If you give us an email address to be told when the extension is live, we store that address, the day you gave it, what sent you and your country. It is used for exactly one message: the day the extension is published. It is not sold, not shared, not added to any other list, and not used for anything else. Ask at contact and it is deleted the same day.

What that means in practice, stated plainly rather than buried:

What they see: the pages you view on this domain, roughly where in the world you are, your device and browser, which site or search sent you, and, through Clarity, how you moved and clicked on the page. Both set their own cookies to do that.
What it does not see: anything at all from inside the extension. The extension ships no analytics of any kind, and the two never speak to each other. Nothing you pick, extract, copy or save is reported here or anywhere else.
Where it does not run: the extension itself, the toolbar, the windows, and the MCP server. Only these web pages.
Turning it off: any content blocker, Do Not Track in a browser that honours it, or Google's own opt-out add-on will stop it, and nothing on this site breaks without it.

What we never do

No accounts, no email collection, no sign in.
No analytics, page tracking, event logging or crash reporting in the extension. The website is covered above.
No selling or sharing of data with anyone, because there is no data to sell.
No sending anything to an AI provider unless you have set your own key, and then only to the one you chose.
No remote code. Everything the extension runs ships inside the package you install and can be read in the store listing's source.
No use of what you extract for advertising, credit assessment, or training anything.

The permissions, and why each one exists

Permission	Why
activeTab	To act on the tab you are looking at when you invoke Verbatim, and only then.
scripting	To inject the toolbar on demand instead of running on every page you visit.
storage	To remember the four things listed above, locally.
clipboardWrite	Because copying the code is the point.
downloads	To save screenshots, page HTML and asset zips to your machine.
http, https	To refetch stylesheets the page cannot read, to reach the Verbatim server on your own loopback address, and, if you set a key, to reach your AI provider.

The MCP server

The optional server runs on your machine, under your account, and drives a local browser. Pages it visits are read there. Nothing is relayed to us, and it has no account to relay it to.

What you may do with what you extract

Verbatim reads pages you already have access to. It does not break into anything, and it does not change what you are allowed to do with what you find there.

What you do with what you extract is your responsibility. Other people's designs, code, fonts and images are usually protected by copyright and by licence terms, and reading them with this tool grants you no right to them. Webfont files in particular are licensed, often in ways that forbid rehosting, which is why the font view names the file rather than offering it for download.

Learning from how something was built, matching a token scale, or rebuilding a pattern in your own work is ordinary practice. Copying a page wholesale and shipping it as yours is not, and no tool makes it so.

Children

Verbatim is a developer tool and is not directed at children. It collects no personal information from anyone, of any age.

Changes

If this ever changes, the date at the top changes with it, and a change that affects what is collected would be announced in the extension itself before it took effect. Given that the answer today is nothing, we do not expect to.

Contact

Questions about any of this: privacy@verbatim.design.