Privacy — Chrome extension

Last updated: 12 September 2026.

What the extension does

• Reads the Facebook Marketplace pages you open yourself — the listing-creation form and your own listings page — so it can fill the form from your catalogue and, if you choose, confirm that a listing was published. It does not read any other part of Facebook: not your feed, not your messages, not your profile, not groups. It has no permission to, and that is enforced by the browser, not by a promise.
• Talks to the Shelfmirror program through that program's own small server on the same computer (http://127.0.0.1, one of the ports 47391–47400). These requests never leave your machine and never travel over the internet. Access is protected by a token you copy from the program into the extension by hand.
• Stores a few things in your browser (in chrome.storage.local, isolated from other extensions and websites): the address and token used to reach Shelfmirror, the current state of an upload run, and a short log of recent actions for troubleshooting. None of it is sent anywhere.

What the extension does not do

• It does not send data to any server other than the Shelfmirror program on your own computer.
• It does not collect or store anything for advertising, analytics, or sale to third parties.
• It does not read passwords, payment details, or anything on pages unrelated to creating a Facebook Marketplace listing.
• It does not execute remote code. Every line it runs ships inside the package you installed.
• It does not publish anything behind your back. By default it fills the form and stops — you look at it and press Publish yourself. Publishing without confirmation is a separate switch, off by default, which you turn on knowingly.

Permissions the extension asks for, and why

This list matches the extension's manifest exactly — every permission it declares is named here, and nothing else is requested.

• storage — keeps the connection settings and the state of an upload run on this computer, so a run survives the browser putting the extension to sleep. Nothing is sent anywhere.
• alarms — lets scheduled work (for example, the once-a-day check of your listings against Facebook) happen without you keeping a tab open. It only wakes the extension's own code.
• http://127.0.0.1:47391–47400 — the Shelfmirror program's own server on this same computer. The range exists because the program takes the first free port of the ten. These requests never leave your machine.
• https://www.facebook.com/marketplace/* — the listing-creation form and your own listings page: the two pages the extension fills in and reads back.
• https://www.facebook.com/checkpoint*, /challenge*, /captcha* — Facebook's own identity-check and captcha pages. The extension does not read these pages and runs no code on them; the permission only lets the browser tell it the address of the tab. When Facebook moves your tab there in the middle of a run, the extension sees that and stops the run with a clear message, instead of waiting for a form that will never appear.

Data collected

None. There is no account, no sign-in, no identifier, and no telemetry. Nothing about you or your listings is transmitted to us or to anyone else.

Chrome Web Store User Data Policy

Our use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Removing the data

Uninstalling the extension removes everything it kept in your browser. Nothing of it remains with us — because it was never with us.

Contact

Email: edwwwardo@gmail.com
WhatsApp: +972547726698