Why Auto Refresh Turbo asks for Chrome permissions

Core tab reload uses storage, alarms, and tabs APIs — optional on-page tools add scripting and host access when you enable them.

Chrome extensions declare permissions up front so you can see what they might do before you install. Auto Refresh Turbo is a single-purpose tool: scheduled tab reload. Each permission maps to a concrete feature — not to a vague “read all your data” grab.

Permission map

| Permission | Why it exists | Needed for core reload? | |------------|---------------|-------------------------| | storage | Save intervals, sessions, UI prefs | Yes | | alarms | Fire reload when popup is closed | Yes | | tabs | Reload tabs, list sessions, badge countdown | Yes | | scripting | Inject optional on-page tools | Only when enabled | | activeTab | Short-lived access when you open the popup | Situational | | Host access (<all_urls>) | Run optional on-page tools on sites you refresh | Only when enabled |

Full legal wording lives in the Privacy Policy.

storage

Keeps your interval, presets, random range, schedule window, session snapshots, language choice, and similar settings in chrome.storage.local on your device.

Without storage, every browser restart would erase your timers.

alarms

Chrome alarms wake the service worker on a schedule so reload continues after you close the popup. The core loop is not tied to a script running inside the web page.

Without alarms, refresh would stop the moment you click away from the extension UI.

tabs

Used to:

Call the tab reload API (normal and hard refresh)
Show which tabs have active sessions in the popup list
Display the optional toolbar badge countdown on the active tab
Re-bind sessions after a browser restart using stored URLs and tab metadata

The extension reads basic tab metadata (URL, id) for sessions you started. It is not a browsing-history product.

scripting

Injected only when you enable features that need to see or touch the page:

On-page visual timer chip
Stop when you click or type
Suspicious-page stop heuristic

If you never enable those options, scripting may not run on a given tab. Core reload still uses the tabs API from the service worker.

activeTab

Grants temporary access tied to user gesture — for example when you open the popup or interact with the extension icon. It avoids asking for permanent broad access for flows that only need the current tab at click time.

Host access

Optional on-page features must run on the same origin you are refreshing. Host permission allows the content script to load there when you opt in.

Chrome may show a prompt the first time you enable an on-page option. If you deny it, core reload can still work; optional tools will not.

What we do not do with permissions

No uploading page HTML or form fields to Auto Refresh Turbo servers
Optional self-hosted Umami and GlitchTip for coarse events and error reports — see Privacy Policy
No selling storage contents to advertisers
No cloud account that mirrors your tabs

If telemetry is added later, the Privacy Policy should update before it ships.

Hard refresh note

Hard refresh uses Chrome’s reload-with-bypass-cache flag. It does not clear cookies or log you out by itself, though some sites react badly to repeated hard reload — see troubleshooting.

How to audit on your machine

Open chrome://extensions
Find Auto Refresh Turbo → Details
Review Site access and permissions
Disable optional on-page toggles in the popup if you want fewer injections

You can also clear extension data from the same details page if you want a clean slate.

FAQ snippets

Why <all_urls> and not one site? Users refresh many different dashboards and queues. Narrow host lists would break legitimate use. Optional scripts still only run on tabs you started refreshing with on-page options enabled.

Can I use the extension without host access? Yes for basic interval reload. Enable on-page extras only when you need them.