Permissions, explained

What the WEM extension can and cannot see

Browser permissions are the honest place to judge a shopping extension, so here is WEM’s complete list — what each permission does, why it exists, and the ones WEM never asks for. This page is checked against the extension’s manifest by an automated test: if the code ever asked for more, this page could not ship claiming less.

The four permissions

storageStore data locally

Remembers your settings and caches recent comparison results on your device, so the widget is instant and works the same way twice.

alarmsSchedule background checks

Wakes the extension periodically to refresh cached prices for items on your Droplist. No alarm ever reads a page.

activeTabAccess the current tab when you click

Powers one-click compare on any shop: the moment you press the button, the browser grants access to that one tab, for that one action. WEM cannot see the tab before you click or after you leave.

scriptingRun the comparison widget on a page

Injects the price panel into retailer pages. It runs only where the host permissions below allow, or where you clicked.

Which sites it runs on

At install: named retailers only

Named UK retailers only — Amazon, eBay, Currys, Argos, John Lewis, Boots and the rest of the supported-shops list — plus wem3.ai itself. Every domain is spelled out in the manifest; there is no wildcard in the install-time grant.

Anywhere else: only when you click

One-click compare on an unlisted shop uses the browser’s activeTab mechanism: pressing the WEM button grants access to that tab, for that action. Before you click, WEM cannot see the page; after you leave, the access is gone.

The wildcard in the manifest — off by default

Security scanners will note a broad host pattern in the manifest’s optional permissions, and they are right to look. It is there because browsers require a pattern to be declared before an extension may even ask for it later — it is how “always show WEM on this shop too” works for a store outside the supported list. It is granted to nobody at install, requested only if you use that feature, scoped to the site you choose, and revocable any time in your browser’s extension settings. If you never opt in, it never applies to you.

What WEM never requests

The permissions shopping extensions are notorious for are absent, and the automated check keeps them absent:

tabshistorywebRequestwebRequestBlockingcookiesbookmarksdownloadsgeolocationclipboardReadmanagementprivacyproxy

No tabs means WEM cannot list your open tabs or read their addresses. No history, no webRequest, no cookies means it cannot watch where you browse, intercept traffic, or read logins. There is no account, and no personal data is required to use it.