Look closely at any web page.
CG Scope tells you how the page in front of you is put together. Measure distances, read an element's real spacing, type and colour, sample any pixel on screen, see what the page weighs, and save the images off it. It contains no networking code at all.
Two honest exceptions, both of them the browser doing what you asked: pressing Download makes Chrome retrieve the images you picked, and the image tools show thumbnails, which the browser loads the same way the page already did. Nothing is sent anywhere, ever, by anything here.
Most extensions that can read the page you are on could send what they read somewhere. This one cannot, and that is enforced by a build guard rather than promised in a paragraph.
The guard refuses to build if fetch,
XMLHttpRequest, sendBeacon,
EventSource, WebSocket,
RTCPeerConnection, importScripts,
eval, new Function, a dynamic import or an
absolute URL appears anywhere in the shipped JavaScript. Its own test
suite breaks it on purpose and checks that it goes red, because a guard
that has never failed is decoration.
Being precise about what that is worth: it is a regular expression over the source, so it stops networking code being added by accident, which is the realistic risk here. It would not stop somebody determined to hide it, and this page is not going to pretend otherwise. The claim it supports is the one above it: there is no networking code, and you can read all of it.
What it does
Five tools, one click away
Click the toolbar icon, pick a tool, and it appears on top of the page you are already looking at. Escape closes it. Nothing is installed into the page and nothing is left behind.
Ruler
Drag a box anywhere and read its width, height, position and ratio. Click any value to copy it, or copy ready-made CSS.
Inspector
Point at an element for its computed spacing, typography, borders and colours. Also lists the colours and font families across the page, scanning up to six thousand elements and saying so when it stops.
Color picker
Sample any pixel on screen, not only inside the page. HEX, RGB and HSL, each one click to copy, with your last dozen kept.
Images
Every img on the page in a grid, filtered by format, with dimensions and missing alt text flagged. Copy the URLs, copy a table, or save the files. Background images set in CSS, inline SVG and canvas are not counted, and the tool says so.
Page report
What the page weighs, broken down by resource type, and which images are loaded far larger than they are displayed.
Click a value to copy it.
Saved into a folder named after the site.
The interface, drawn with the extension's own stylesheet.
Verify it
Do not take the privacy claim on trust
Every extension says it respects your privacy. Here is how to establish it for this one in about two minutes, without taking anybody's word.
Watch it on the network tab
Open DevTools, go to Network, and use the Ruler, the Inspector or the Color picker on any page. Nothing appears, because nothing is sent. There is no server to talk to and no account to belong to. The two image tools are the exception, and not a secret one: they draw thumbnails, so the browser may re-request an image it has dropped from cache, and Download asks it to retrieve the files you picked.
Read the permissions it asks for
Four, listed below, each tied to a feature you can point at. Chrome will show you exactly one warning when you install it, "Manage your downloads", which is the Download button in the Images tool. That is the only one, and you should be suspicious of any page that tells you there will be none.
What matters more is what it does not ask for. There are no host
permissions, so it never has standing access to the sites you
visit. activeTab hands it the one tab you are looking
at, at the moment you click the icon, and then expires. It does
not request tabs, which would give it the address and
title of every tab you have open and appears at install as "Read
your browsing history".
Run the guard yourself
The source is public and the check that enforces all of this is one command. It scans the shipped code, refuses on the networking constructs listed above, parses every JavaScript file it ships, and its own test suite proves each guard is capable of failing. The second command is that test suite: eighty-three cases, most of which assert that a guard refuses something.
.\build.ps1 check .\build.ps1 selftest
Permissions
What it asks for, and why
Every permission names the feature that needs it. A permission whose feature does not exist gets removed, and that has actually happened twice in this extension's history.
| Permission | What needs it |
|---|---|
activeTab |
Every tool. It grants access to the tab you are looking at, at the moment you click the toolbar icon, and then it expires. It is not standing access to anything. |
scripting |
How a tool is placed onto the page you clicked from. activeTab grants the right; this is the API that exercises it. |
storage |
The colour picker's last dozen colours, and its two settings: whether sampling copies automatically, and which format it copies. Stored on your machine, never sent anywhere. |
downloads |
The Download button in the Images tool. Your browser retrieves the file you pointed at, the way it would if you clicked a link. |
Deliberately not requested: no host permissions and no
<all_urls>, no tabs, no
history, no cookies, no
webRequest, no webNavigation. Nothing observes
anything when you have not clicked the icon.
Privacy
The whole policy
This is the entire statement. There is no longer version.
CG Scope collects no data. It has no server, no account and no analytics. It makes no network requests of any kind. Nothing you do with it is transmitted, logged, shared or sold, because there is no mechanism in the extension by which that could happen.
Three things are stored on your own computer and nowhere else: the last twelve colours you sampled, whether you have turned on copy-on-sample, and which of HEX, RGB or HSL that copies. They live in your browser's local extension storage. Removing the extension removes them. That list is exhaustive, and it is the same list submitted on the Chrome Web Store privacy form.
When you click the toolbar icon, the popup reads the address of the tab you are looking at so it can tell you whether the tools will run there, and say why if they will not. That address is used to draw one line of text in the popup. It is not stored, not remembered between clicks, and not sent anywhere. No other tab is readable, before or after.
When you press Download, your browser retrieves the images you selected and saves them, exactly as it would if you had clicked a link. The extension does not see the file contents, and nothing about that request reaches us.
Questions: [email protected]