Permissions

Last updated October 21, 2026 · Sideview 1.1.0

Sideview’s single purpose is to show an AI chat website of your choice in Chrome’s side panel. Every permission below exists to serve that purpose. The extension has no analytics. The free version doesn’t read page text or conversation contents, and does not contact Sideview’s servers. AI sites connect directly to their own services. The free extension’s only content scripts are small page fixes that run inside the panel’s frame of a provider you have allowed, to make that site work there, and a chat tracker that tells the panel which chat each tab shows so it can reopen it.

Asked for when you install

• sidePanel: shows the chat in Chrome’s side panel, opens it from the toolbar icon, and toggles it with the keyboard shortcut.
• storage: saves your preferences in your browser: your open tabs (each one’s provider, and the address and title of the chat it shows), your start provider, which providers appear and in what order, the theme, the idle-unload timeout, site rules and your cached Pro status. Pro saved prompts use Chrome’s sync storage, so Chrome carries them to your other devices. None of it is sent to us.
• declarativeNetRequestWithHostAccess: AI chat sites send headers that stop them loading inside a frame, and the side panel is one. One rule per provider removes only those two headers, as described below.
• contextMenus: adds Sideview’s right-click actions for Pro users. The menu is not created for free users.
• activeTab: lets Pro read a page or capture its visible area when you invoke a shortcut or right-click action on that page. It does not grant standing access to other pages.
• scripting: registers the page fixes described below on providers you have allowed. Pro also registers the provider bridge and the optional Quick chat dock, and uses it, with contextMenus and activeTab, for the Pro tools. Those two do nothing for free users.
• Access to each supported AI chat site (ChatGPT, Claude, Gemini, Copilot, Grok, Meta AI, Le Chat, Qwen, Kimi, Poe, Duck.ai, Perplexity and DeepSeek), plus ChatGPT’s and Qwen’s sign-in hosts, so every provider works the first time you pick it, without a prompt. Each host is matched exactly, with no wildcard subdomains. You can turn any of them off in Chrome’s settings for Sideview.
• browsingData: before the panel loads Perplexity, Sideview removes service workers only for https://www.perplexity.ai. An existing worker can answer the panel with saved pages that cannot load in a frame. This removes no cookies, history or other site data. Perplexity sets the worker up again the next time you open it in a tab.

Asked for only when you use the feature

• sideview.app: requested when you click Sign in or Upgrade to Pro. It lets the extension ask this site whether your account has Pro. The request says nothing about your browsing, providers or conversations.
• tabs: Pro only. Requested when you add a site rule. It lets the panel compare the open tab’s address with your rules, in memory. Addresses are not stored or sent.
• All sites. Pro only. Requested when you enable the Quick chat dock, or the first time you choose Add a screenshot of the page from the panel’s ⋯ menu. With the dock enabled, a bundled content script adds its interface to ordinary web pages, excluding supported AI sites and sideview.app. It reads selected text when you send a message, and includes page text or a screenshot only if you choose those options. A click inside the side panel does not grant activeTab, so capturing the visible tab from the panel also needs this permission. If you decline, screenshots still work from the right-click menu and keyboard shortcut on eligible pages. The dock is off by default.

How the frame headers are changed

Provider sites send X-Frame-Options and Content-Security-Policy (frame-ancestors) headers that stop them loading in the side panel. Sideview removes those two headers, and only when all of these hold:

• The response is for an embedded frame. Top-level pages are never modified.
• The request goes to that provider’s own hosts.
• The request isn’t from a browser tab. Side panel frames report no tab, so your normal browsing, including visits to the same sites in a tab, is never affected.
• The request was started by Sideview or by that same provider inside the panel. Each provider has its own rule, so one provider’s page can’t be used to frame another.

Sign-in pages are never made embeddable. When a provider starts signing in inside the panel, Sideview sends that frame to its own page, which offers to open sign-in in a normal tab. It never opens a tab without a click.

One trade-off: Chrome’s rules can’t edit part of a header, so removing Content-Security-Policy removes the whole policy for that frame. This applies only inside Sideview’s panel. The same sites in a tab keep their policy.

Tabs and the chat tracker

Each tab in the panel is one chat. To bring your chats back when you reopen the panel, Sideview remembers each tab’s provider and the address and title of its chat, in your browser only. A tab’s entry is deleted when you close it. Provider sites are separate origins, so a small script inside the panel’s frame tells Sideview the page’s address and title. It runs only on providers you have allowed, only inside the panel, reads nothing else, and sends them only to the extension.

Reopen last closed chat temporarily keeps the most recently closed tab in browser session storage. It is removed when restored or the browser session ends. With Continue where you left off turned off, only its provider is kept across panel reopens, without the chat’s address or title.

Microphone, camera and location

AI sites in the panel can use your microphone (for voice input), camera and location only after you allow them in Sideview’s settings, under Microphone & camera. A side panel can’t show Chrome’s permission prompt, so the settings page asks Chrome for you. The access check switches the microphone and camera off straight away and ignores the location. Once allowed, any provider in the panel can ask to use them, as it could in a tab. You can change or take back these choices in Chrome’s settings at any time.

Page fixes

A few provider sites need a small script inside their frame to work in the panel. Each one runs only on that provider’s site, only once you have allowed it, and only when the page is inside Sideview’s panel. The same site in a normal tab is never touched. None of them makes network requests, stores anything, sends anything to us, or reads your conversations.

• Claude. Inside a frame, Claude shows a compact interface without its sidebar. The script sets the one setting that controls this, so you get Claude’s full interface with chat history, projects and navigation.
• Perplexity. Stops the site installing a service worker from inside the panel.
• DeepSeek. DeepSeek’s bot check saves a cookie that Chrome would otherwise reject inside the panel. The script marks the site’s cookies so Chrome keeps them, in a cookie jar kept apart from the site’s cookies in normal tabs.

What the Pro tools touch

These tools are off for free users. The Pro right-click menu, provider bridge and Quick chat dock are not registered. The free chat tracker and provider page fixes are separate.

• Quick chat dock. Reads selected text when you submit a message. Include this page adds page text, and Add a screenshot captures the visible tab. Sending submits the message to the chosen AI; showing the dock does not send page content. Turning it off removes its content-script registration.
• Send page and right-click actions. Sideview reads a page only when you ask from that page, by a right-click item or a Sideview keyboard shortcut. Chrome’s activeTab grants access to that one tab for that one request. The text, up to 20,000 characters, goes into the chat box of the provider on screen.
• Screenshots. The same grant lets Sideview capture the visible part of that tab. The picture is attached to the chat box as a pasted image would be. For screenshots from the panel, shortcut or right-click menu, you then press send in the AI chat. A Quick chat dock submission sends the screenshot with your message. It is not sent to Sideview’s servers.
• Provider bridge. Provider sites are separate origins, so the panel can’t type into them or read them. For Pro users, a content script runs only on provider hosts you have already allowed, and only when the page is framed directly by Sideview. It can put text in the chat box, attach a screenshot, press send, and read the conversation on screen when you choose Export. It makes no network requests and stores nothing.
• Export. The conversation is read when you choose Export, turned into Markdown, and saved as a file or shown on a print-ready page inside the extension. It isn’t sent anywhere. Each PDF has its own snapshot, passed through browser session storage and kept in the print tab’s session cache for reprinting. Exports include the source chat URL and export timestamp.
• Text and screenshots in transit. A prompt or screenshot started outside the panel waits in Chrome’s session storage, which is memory only, until the panel picks it up. It is then deleted.

Your Pro status

You sign in on this website, not in the extension. Once you allow access to this site, the extension makes one kind of request: it asks whether someone is signed in and whether they have Pro. Chrome attaches this site’s own session cookie. The extension never sees or stores your password or a sign-in token. It stores the answer locally (signed in or not, plan, account email and when it was checked) and asks again regularly, so signing out here removes Pro from the extension within a few minutes. Without the permission, no request is made.

Limits on access

• Access to ordinary browsing sites is optional, for Pro screenshots and the Quick chat dock. The free version only needs the supported provider hosts and their configured sign-in hosts.
• No content scripts in the free version other than the page fixes and the chat tracker, and none on any site other than AI providers you have allowed.
• tabs is optional and only for Pro site rules.
• No remote code. Every script ships in the extension package.

Questions about any of this: support@sideview.app. See also the Privacy Policy.