What the Closo extension can read (and what it can't)
An honest breakdown of every permission Closo asks for, what we use it for, and what we deliberately don't touch.
Updated June 14, 2026
Installing a browser extension means giving software access to your browser. That's a real decision, and you deserve a clear answer to 'what does this thing actually do?' This article walks through every permission Closo asks for, what we use it for, what we deliberately don't do, and how you can verify any of it yourself.
Our source code is in our private repository today, with a plan to publish the extension source publicly later this year. In the meantime, you can inspect everything the extension does from Chrome's built-in tools — we'll show you how.
Permissions, one by one
Chrome groups extension permissions into categories. We declare 10 of them. Here's what each one does and why we need it.
storage
Lets the extension save settings and tokens locally on your device — for example, which marketplaces you've connected, your preferred timezone, your Closo API key. Stored in Chrome's local storage on your machine, not synced to Google. Never sent to anyone except Closo over HTTPS.
cookies
Lets the extension read marketplace login cookies (Poshmark, Depop, Mercari, Vinted, eBay, Shopify). This is how we keep you logged in across crosslists. We only read cookies from those 6 sites — Chrome enforces this via host_permissions.
webRequest + webRequestExtraHeaders
Lets the extension watch when a marketplace sets a new login cookie or refreshes a token. When Poshmark issues a fresh session cookie during your normal browsing, we notice and capture it — that's how your session stays valid through the next crosslist. We watch only requests to the 6 marketplaces. Other sites are invisible to us.
Lets the extension register network-request rules that apply only to the marketplaces and to closo.co. We use these to make sure the requests we send carry the headers a marketplace expects, scoped to the sites the extension is allowed to touch — never to other sites you browse.
background
Keeps the extension's background service worker alive so it can pick up queued jobs and respond to marketplace events while you do other things. It's the engine that runs the rest of the permissions; it doesn't read pages on its own.
tabs
Lets the extension open and close marketplace pages in the background. When you click Crosslist, the extension opens (and closes) a Mercari listing page off-screen. We don't read tabs that aren't marketplaces.
alarms
Lets the extension schedule a background tick (roughly every 30 minutes) so it can sync whatever fresh cookies your browsing produced and refresh Vinted's token. Without this we couldn't keep your sessions warm while you're doing other things.
scripting
Lets the extension run its own code on marketplace pages (so we can fill forms and read status messages). Restricted to the 6 marketplaces + closo.co — Chrome enforces this at the OS level.
host_permissions (6 marketplaces + closo.co)
The most important limit. The extension can only see and modify pages on poshmark.com, depop.com, mercari.com, vinted.com, ebay.com, shopify.com, and closo.co. Your Gmail, your bank's website, Twitter, Reddit, Amazon, your work tools — all invisible to the extension. Chrome refuses to let us see them, and we wouldn't want to.
What we deliberately don't do
Some things we could technically do but never have, and never will:
Read non-marketplace tabs
Technically forbidden by host_permissions. Even if a future bug let us, our code has no path for it. The extension simply doesn't observe tabs outside the 6 marketplaces and closo.co.
Sell or share your data with anyone
Your listing data and marketplace data go to Closo's servers and stay there. We don't sell aggregated data, we don't share with marketplaces, we don't run analytics partnerships. The only third parties who see anything are payment processors (Stripe, Plaid for bank connections) and email senders (Postmark, SendPulse for transactional email).
Track your shopping behavior
When you browse Poshmark or Depop as a buyer, none of that goes to Closo. We only observe requests related to seller actions — listings, edits, sales — and only on accounts you've connected. We do not analyze your buying activity.
Read your saved passwords
Chrome's password manager is a separate system the extension cannot touch. Your bank logins, social media passwords, anything saved in Chrome — completely invisible to us.
How to verify yourself
Don't take our word for it. Chrome makes the extension's permissions and behavior visible to anyone who wants to look:
Open chrome://extensions in your browser, find Closo, and click Details. The exact permissions list is shown there. You can change 'Site access' to 'On click' if you want to manually approve the extension per marketplace before each session. Closo will be slower (you'll have to click for each crosslist) but for sellers who want maximum control this is a real option.
If you're technical, open Chrome DevTools on a marketplace page and watch the Network tab. You'll see the same requests the extension makes — they're not hidden. Every fetch, every cookie, every webRequest is visible to anyone running DevTools.
Reporting concerns
If you find something the extension is doing that this article doesn't explain, we want to hear about it. Email security@closo.co with what you saw. We respond within 24 hours on weekdays, faster for anything that looks urgent.
We update this article whenever the extension's permissions change.