PaperTab Outbound Network Requests Audit
PaperTab does not have user accounts, analytics, tracking, or PaperTab-operated backend servers. Your visual assets, drawings, and board configurations are stored locally on your device in IndexedDB and chrome.storage.local.
However, the extension does initiate outbound network requests in specific user-triggered or user-configured scenarios. This document catalogues every outbound request made by PaperTab.
Outbound Requests Table
| Feature / Location | Trigger | Destination | Data Transmitted | User Control & Permissions |
|---|---|---|---|---|
| Quick Links Favicons | Rendering quick links on new tab page when Quick Links widget is active | https://www.google.com/s2/favicons?domain=...&sz=64 (Google Favicon Service) |
Hostname / domain of the configured quick link | User adds, edits, or deletes quick links; can disable the Quick Links widget entirely in Settings. |
| Search Bar Submissions | User submits a query in the new tab search bar widget | User's selected search engine (google.com, duckduckgo.com, bing.com, or search.brave.com) |
Search query string (?q=...) |
User types the query and explicitly submits; user selects preferred search engine or disables search bar widget in Settings. |
| Canvas Drag-and-Drop External Image | User drags and drops an external image from another browser tab onto the canvas | The host origin of the dropped image URL | HTTP GET request to download image bytes for local ingestion | Initiated directly by a user drag-and-drop gesture. No host permission is held, so this is a normal cross-origin request; if CORS blocks it, the request takes longer than 15 seconds or the image is larger than 50 MB, a plain link card is created instead. |
| Help & Support Link | User clicks "Open" next to Help & Support in Settings | https://realmisadev.featurebase.app (PaperTab feedback portal, hosted by Featurebase), opened as a normal page in a new tab |
Nothing beyond an ordinary page visit; whatever the user chooses to post on the portal | Only on an explicit click. Nothing is loaded from the portal inside the extension. |
Network Principles
- No PaperTab Servers: PaperTab has zero proprietary cloud infrastructure. No boards, drawings, notes, or uploaded images are ever sent to PaperTab.
- No Analytics or Telemetry: No tracking scripts, analytics SDKs, session recording, or pingbacks exist anywhere in the codebase.
- No Host Permissions: The extension declares no host permissions, so it cannot fetch arbitrary sites on your behalf. Link cards are created from the URL you paste or drop without contacting the linked site.