Privacy and permissions
What Xakto asks Chrome for, what it keeps, and what leaves your computer.
Permissions
| Read and change data on all sites | To work on whichever site you switch it on for. Xakto isn't added to any page until you click its icon. |
| Scripting | To add its tools to the tab you switch it on in. |
| Active tab | So the icon acts on the tab you clicked. |
| Tabs | To know which tab it's on. |
| Storage | For your settings, which tabs it's on, and the agent connection. |
| Clipboard | To copy CSS, prompts and images. |
| Identity | For Continue with Google when you sign in to Pro: Chrome's own sign-in window, asking only for your email. |
What it keeps
Everything Xakto keeps stays in Chrome on your computer: your settings, the agent pairing token, each page's recent checks (up to 100 pages), your decisions on findings and the Check by hand ticks, your own findings and annotations, each with a small picture of its element, each site's annotation categories and finding numbers, which tabs Xakto is on, and on Free the addresses of the pages you checked or extracted this month. With Pro your list of changes is kept until you close the tab or the browser, and printable reports, the last four, until you close the browser.
What leaves your computer
- What you look at or change is never sent anywhere, and there are no analytics.
- Free has no account. Pro does: signing in sends your email, by a one-time code or Google, and once a day this browser asks Xakto's server for its plan, sending a random install ID and getting back a signed pass. The server keeps your email, your plan and the browsers you use it in.
- Clone, exports and saving an image fetch the page's own images, stylesheets, fonts and icon files again, from the site they came from.
- The Check's 320px test loads the page a second time in a hidden frame, and Responsive mode loads it again in its frame.
- The full site scan reads the site's other pages, its robots.txt and sitemap.
Your coding agent
The agent connection is off until you turn it on. The relay runs on your computer, listens on 127.0.0.1 only, and pairs with Xakto using a token that's never sent over the connection. Clones your agent asks for are saved in your computer's temporary folder. Your agent may send what it reads to its own model provider.