What a local-first extension can (and can't) see
"Privacy-first" is the easiest claim in software to make and the hardest to verify. An extension sits inside your browser, next to your email, your bank, and your DMs — so "just trust us" isn't good enough. Here's the concrete version: exactly what Bulk Image Downloader is able to do, and exactly what it can't.
The one rule everything follows
The extension does nothing until you click its icon — and even then, only on the tab you clicked it on.
There's no background process watching your browsing, no content script injected into every page you visit. It's inert until you deliberately invoke it, and then it looks at one tab: the one in front of you.
What it can do — when you ask
- Read the current page to find images. When you click the icon, it scans that tab's DOM for image sources —
<img>,srcset, CSS backgrounds, lazy-loaded and shadow-DOM images. - Fetch image bytes on your device. To build a ZIP or to fingerprint images for duplicate detection, it downloads the image data into the page — the same bytes your browser already loaded — and works on them locally.
- Save files to your Downloads folder. That's the whole point. Downloads land where every other download does.
- Remember your settings. Your thumbnail size, sensitivity, and folder rules are stored in the browser's local storage, on your machine.
What it can't (and doesn't) do
- No uploads. There is no server. Images, filenames and URLs are never transmitted anywhere — there's nowhere for them to go.
- No account, no sign-in. Nothing ties what you do to an identity, because there's no identity to tie it to.
- No other tabs, no history. It can't read tabs you didn't invoke it on, and it never reads your browsing history or bookmarks.
- No always-on tracking. Because it isn't running in the background, there's nothing to track between the moments you use it.
The permissions, in plain words
Chrome makes an extension declare what it needs. Here's the whole list and why each one is there:
activeTab— read the current tab, and only after you click. This is the narrow, on-demand permission, not blanket access to every site.scripting— run the small scan routine in that tab to collect image sources.downloads— save the files you pick.storage— keep your settings locally.<all_urls>(optional) — not granted up front. Some servers block cross-origin requests, so a handful of images can't be fetched for a ZIP or for de-duplication. Only then does the extension ask — with a clear prompt — whether you'd like to grant broader access to include them. Say no and it simply skips those images.
The optional permission is the important detail. A less careful extension would just request access to all sites on day one. This one waits until there's a concrete reason, explains it, and lets you decline.
About analytics
Usage stats are off by default. If you choose to turn them on, they're anonymous and content-free: counts and feature names only — "a ZIP was created", "duplicates were checked" — never a URL, a filename, or a pixel of an image. And it's a single switch to turn back off.
Don't take our word for it
The healthiest way to trust a local-first tool is to not have to. A couple of things you can check yourself:
- Open your browser's task manager or a network tool while you use the extension. You won't see it phoning home, because it doesn't.
- The code is open source. The scanning, hashing and ZIP logic is all there to read — see the source on GitHub.
Local-first isn't a slogan here; it's the architecture. There's no server to leak, no account to breach, and nothing to sell — because your images never leave your device in the first place.