The extension
Permissions explained
Why the extension asks to run on the pages you visit, and what storage, activeTab and the one host permission are for.
Updated
The manifest declares a short list. Here is what each entry does.
Read and change data on the sites you visit
The content script runs on every http and https page (and inside frames) so it can find posts and images near your viewport and draw the circle. Chrome and Firefox describe that as reading and changing data on all sites. What the script actually reads is the user-generated content it checks; what it changes is the overlay it adds. It does not read form fields, passwords or bookmarks, does not transmit page URLs, and does not modify the site's own content except to collapse a post you hide.
storage
Keeps your settings (sensitivity, per-site switches, lists, Pro rules), your extension token, and a per-tab memo of recent verdicts in session storage so a post is not re-analysed while you scroll. The memo is cleared when the browser closes.
activeTab
Lets the popup read the address of the tab you have open, so it can name the site under Scan this site and tell you when a page cannot be inspected.
Host permission: api.slopsquash.com
The only server the extension talks to. Detection batches, reports and rechecks go there and nowhere else. A second entry for 127.0.0.1:8787 exists for developers running the API locally.
Firefox data collection notice
Firefox shows a data-collection summary before installation, listing what an add-on may send. For Slop Squash that is the content it analyses when network detection is on. You can stop all of it with on-device only mode.
No remote code
The extension loads no code from the network. Everything it runs ships in the package that the store reviewed.