The HAMRA Companion extension requests a focused set of Chrome permissions. Here's exactly what each one is for.
activeTab + tabs
Used to open and focus tabs during an Autopilot run. The extension opens each queued application in a new active tab so you always see what's being submitted.
scripting
Used to inject content scripts on demand (for Greenhouse-hosted job pages that don't have a fixed URL pattern). Not used to inject arbitrary code.
storage
Stores your HAMRA pairing token, your auto-apply settings (local cache), and per-platform rate-limit state. All data stays in chrome.storage.local on your machine — never sent to a third party.
sidePanel
Powers the side panel that shows the current job's full match breakdown when you click the extension icon on a supported page.
alarms
Drives the Autopilot run cadence — the extension can't run a long async loop in MV3, so each "next item" tick is an alarm.
host_permissions
Limited to specific job-board origins (linkedin.com, naukri.com, indeed.com, plus the 8 ATS host patterns we support). The extension cannot read or modify any other site.
What the extension does NOT do
- It does not read your browsing history.
- It does not access tabs outside the supported job-board origins.
- It does not send your form data anywhere except hamraofficial.com (your own HAMRA account).
- It does not run in the background when you're not actively using it.