Revoke (“the extension”) helps you review and revoke third-party access to your accounts. This policy describes what data the extension handles and where it goes.
Summary
- Revoke has no backend servers and no Revoke user accounts.
- Your app list, notes, audit log, and settings are stored only in your browser via
chrome.storage.local. - Optional AI features send data to Google Gemini only when you add your own API key and enable AI.
- Sync and revoke open platform settings pages in background tabs in your browser; Revoke does not receive a copy of your passwords.
Data stored locally
On your device, Revoke may store:
- Names and metadata of connected apps and Chrome extensions (platform, risk level, scopes when available, notes you add).
- Sync and revoke history (audit log).
- Extension settings (e.g. Gemini API key, model name, configured account hints, bug-report email).
- Debug logs you generate from the side panel (for troubleshooting).
This data stays in your Chrome profile unless you uninstall the extension or clear extension storage.
Network activity
Platform websites
To sync or revoke, Revoke navigates to official settings URLs (Google Account connections, GitHub applications, LinkedIn permitted services, Facebook Apps and Websites, Microsoft consent manager, X connected apps, Discord Authorized Apps, etc.) and runs scripts on those pages in your browser to read or click UI elements. Traffic is between your browser and those sites, not through a Revoke server.
Google Gemini (optional)
If you enable AI and provide a Gemini API key:
- Screenshots of open tabs and prompts may be sent to Google’s Generative Language API (
generativelanguage.googleapis.com) to navigate or extract app lists when deterministic scraping is insufficient. - Your API key is stored locally and sent only to Google as part of those API requests.
- Revoke does not operate a proxy; Google’s terms and privacy policy apply to that processing.
You can use Revoke without AI by leaving the API key empty; data-first sync does not call Gemini.
Bug reports
The “Report a bug” flow builds an email on your device (mailto:). Debug text is sanitized (API keys, screenshots, and common secrets removed). Nothing is uploaded automatically to Revoke.
Permissions
| Permission | Purpose |
|---|---|
storage | Save app list, settings, audit log locally |
sidePanel | Show the Revoke UI |
tabs / windows | Open platform settings pages for sync/revoke |
scripting | Run page scripts to read app lists and revoke access |
management | List and uninstall Chrome extensions you choose to revoke |
debugger | Attach briefly for screenshots (optional AI) and reliable clicks on some sites; detached when done |
| Host permissions | Only the domains needed for supported platforms and the Gemini API (see manifest.json) |
Chrome may show a notice while the debugger is attached during sync, enrichment, or revoke.
Data sharing
Revoke does not sell or rent your data. We do not operate analytics or advertising SDKs in the extension.
Data leaves your device only when:
- You use optional Gemini (to Google, under your key), or
- You use normal HTTPS to sign in or manage apps on each platform’s website, or
- You send a bug-report email yourself.
Children
Revoke is not directed at children under 13.
Changes
We may update this policy as the extension changes. The “Last updated” date will be revised accordingly.
Contact
For privacy questions, open an issue or contact address listed on the Chrome Web Store listing or project repository.