Privacy

Last updated 10 September 2026

Verbatim collects nothing. There is no account, no sign in, no analytics, no telemetry, and no server of ours for anything to be sent to. We could not see what you extract even if we wanted to.

Everything below is the long version of that sentence, so you can check it rather than take our word for it.

What the extension can see

Verbatim has no content script that runs on page load. Nothing is injected into any page until you click the toolbar icon or press the keyboard shortcut. From that moment, on that tab, it reads the page the way your browser's own inspector does: the DOM, the stylesheets, the computed styles, the fonts and the images.

It reads that information to show it to you. It is not recorded, not aggregated, and not transmitted.

What it stores, and where

Four things, all in chrome.storage.local, which lives on your own device and is never synced to us:

Key	What it holds
options	Your settings: colour format, default scope, Tailwind version, whether resets are dropped, and so on.
toolbarPosition	Where you dragged the toolbar, so it reopens there.
windowGeometry	The size and position of the component, clone and asset windows.
options.bridgeToken	The token you paste in to connect the extension to the Verbatim server on your own machine. It is generated by that server and never leaves your device.

Removing the extension removes all of it.

What leaves your browser

Two things, and only these:

Stylesheet requests. A page can load CSS from another domain but is often forbidden from reading it back, which is exactly the information Verbatim needs. So the extension refetches those same stylesheet URLs, with credentials omitted, so no cookie of yours is attached. The request goes to the same server the page already loaded that file from, and nowhere else.
Handoffs to your own machine. If you press G to send a selection to your coding agent, it is posted to 127.0.0.1, the loopback address of the computer you are sitting at. It does not traverse the internet. The server refuses any request without the token in your settings, so a web page that happens to probe your local ports cannot read your captures or plant one.

Screenshots, saved HTML and asset zips are written by Chrome's own download system to your disk. They are built in the browser and never uploaded.

What we never do

No accounts, no email collection, no sign in.
No analytics, page tracking, event logging or crash reporting.
No selling or sharing of data with anyone, because there is no data to sell.
No remote code. Everything the extension runs ships inside the package you install and can be read in the store listing's source.
No use of what you extract for advertising, credit assessment, or training anything.

The permissions, and why each one exists

Permission	Why
activeTab	To act on the tab you are looking at when you invoke Verbatim, and only then.
scripting	To inject the toolbar on demand instead of running on every page you visit.
storage	To remember the four things listed above, locally.
clipboardWrite	Because copying the code is the point.
downloads	To save screenshots, page HTML and asset zips to your machine.
http, https	To refetch stylesheets the page cannot read, and to reach the Verbatim server on your own loopback address.

The MCP server

The optional server runs on your machine, under your account, and drives a local browser. Pages it visits are read there. Nothing is relayed to us, and it has no account to relay it to.

Children

Verbatim is a developer tool and is not directed at children. It collects no personal information from anyone, of any age.

Changes

If this ever changes, the date at the top changes with it, and a change that affects what is collected would be announced in the extension itself before it took effect. Given that the answer today is nothing, we do not expect to.

Contact

Questions about any of this: privacy@verbatim.design.