The install warning, explained.

"Modify data you copy and paste"

This is your browser's wording for a permission called clipboardWrite, and the wording is considerably more alarming than the permission.

clipboardWrite allows one thing: putting something on your clipboard. It does not allow reading the clipboard. Reading is a separate permission, clipboardRead, which PagePress does not request and therefore cannot use. So the extension cannot see the password you copied out of your password manager, or the address you copied out of an email. That is not because it chooses not to look, but because the browser will not let it.

What it does use the permission for is the Copy buttons: Copy in the popup and in the editor, which place the finished capture on your clipboard as a PNG, and Copy prompt in AI Markup, which places your review on it as markdown. Each one runs when you press it, and puts there exactly what the button says it will.

"Manage your downloads"

This is the downloads permission, and this warning is the fairer of the two: the download API does include the ability to read your download history and erase entries from it, so your browser is right to mention it.

PagePress uses two parts of that API. It calls download to write the finished PNG, JPEG, WebP or PDF to your downloads folder. This is the Save button, and there is no other way for an extension to hand you a file. And it watches that one download until it finishes, because a capture of a long page is held in memory as a blob while it saves, and the moment the file is written that memory can be released. A full-page capture can run to tens of megabytes; without that signal it would sit in memory until you closed the tab.

It does not read your download history, and it does not erase, open or relocate anything you have downloaded. The parts of the API that do those things are not called anywhere in the extension.

What the warning did not say

Worth noticing as much as what it did. There was no "read and change all your data on the websites you visit". That is the warning almost every screenshot extension shows at install.

PagePress asks for no host permissions at install. It reaches a page through activeTab, which grants access to a single tab, for a single action, only after you click the toolbar icon or press the keyboard shortcut. It cannot read a page you have not invoked it on, and it has no standing access to any site. The one exception is a page whose content sits inside a cross-origin frame, where the browser prompts you separately, for that site, at the moment you ask for the capture.

Every permission and its purpose is listed in the privacy policy.

Why does Brave say it doesn't review extensions?

Brave installs extensions from the Chrome Web Store but does not run a review process of its own, so it tells you so. The PagePress listing was reviewed and published by Google, and the Firefox build by Mozilla. The notice is Brave being precise about who checked what, not a sign that anything was skipped.

Can I verify any of this myself?

Yes, and you do not have to take the paragraphs above on faith.

• See the exact permissions. Open brave://extensions (or chrome://extensions, or about:addons in Firefox), click Details on PagePress, and read the permissions list. It is generated by the browser from the extension's manifest, not written by us.
• Watch it talk to nobody. Open your browser's developer tools on the extension's own pages, go to the Network tab, and take a capture. PagePress has no server to contact, and nothing leaves your machine. The Network tab is where that claim either holds or visibly fails.
• Check where files go. Saved captures land in your normal downloads folder, named after the page, and nowhere else.

Where do my captures go?

Onto your device, and no further. The capture is stitched, encoded and edited inside your browser; it is saved to your downloads folder or copied to your clipboard, both at your instruction. The extension has no account, no upload, no sync and no analytics of its own. The privacy policy is the long form of that answer.

Does this website track me?

Only if you let it. This website, not the extension, uses Google Analytics to count visits and see which pages get read, and it asks before it runs. Until you press Accept no Google script is fetched and no cookie is set, and if you press Reject that stays true. Either way you can change your mind through Cookie settings at the bottom of any page, and rejecting there deletes the analytics cookies already in your browser.

The extension is a separate matter, and the answer there is no under any setting: it has no analytics and contacts no server at all. The privacy policy lists exactly what Google Analytics collects if you do accept it.

Still have a question?

Ask it on the support page and it may end up on this one.