What is not collected
The extension collects nothing about you. No analytics, no usage statistics, no crash reports. There is no server behind it, so there is nowhere for anything to be sent.
Where PDFs are processed
Entirely in your browser. Parsing, structure extraction and page rendering all happen on your machine. A PDF you open is never uploaded.
Image descriptions and OCR are optional and use the browser's own on-device model. No image leaves the machine. Where no on-device model is available, the feature is simply not offered — which is always the case in Firefox, since it has none an extension can use.
When a PDF is opened from a URL, the browser fetches it as it would any download, and the server hosting it sees an ordinary request.
What is stored
Only settings — font size, line height, column width, typeface, theme, which reading of a tagged PDF to open with, which language the interface is in, and which language generated descriptions are written in. No document content.
Whether PDFs open in the Reader is not among them: that one is a browser permission rather than a setting, it belongs to the device it was granted on, and the settings panel reads it back from the browser rather than remembering an answer of its own.
They live in the browser's sync storage, so they follow you between devices signed into the same browser. Those settings are all that is synced.
Permissions
| Permission | Why |
|---|---|
activeTab |
A temporary grant for the one tab whose toolbar button you pressed, which is what allows the PDF's bytes to be read. It does not extend to other tabs. |
storage |
Saves the display settings above. |
contextMenus |
Adds "open in Accessible PDF View" when you right-click a link to a PDF. Running that item is itself one of the gestures that grants the temporary access above. |
sidePanel |
Opens the settings in the browser's side panel. Chrome only: in Firefox the settings open in the sidebar, which needs no permission. |
declarativeNetRequestWithHostAccess |
Registers the redirect rule behind the "Opening PDFs" setting, and only
for sites you have granted access to — which is what the
WithHostAccess half of the name means.
|
None of those is a host permission, and installing the extension grants access to no site at all.
One optional host permission exists, and nothing asks for it until you do something that needs it. There are two such things.
-
One site, when a PDF could not be read. The temporary
access above covers the tab you pressed the button in, so a PDF on a
different site — a link you right-clicked, say — is out of
its reach. In Firefox it is out of reach for any PDF from another site,
because Firefox's
activeTabdoes not cover reading a file. When that happens the Reader names the site and offers to ask for that one site. Access you grant stays until you remove it in the browser's own extension settings. -
Every site, for Opening PDFs. Switching
Opening PDFs to the Reader asks for access to every
httpandhttpssite; switching it back hands that access in again. Sending a PDF to the Reader means recognising its address before the page loads, and no browser allows that for sites an extension cannot already reach — so the feature costs that access, and there is no smaller version of it.
Do neither and nothing is ever asked for. Access you grant does not change what is collected: still nothing, and nothing is sent anywhere.
For Opening PDFs, the rule itself is declarative: the browser matches it and acts on it, so the extension sees no request, runs no code as you navigate, and learns nothing about what you visit.
This site
No analytics, no cookies, no external scripts or fonts. The hosting provider (Cloudflare) keeps the operational records it needs to serve the site.
This site runs exactly one script — it remembers the
Theme choice at the top of the page by writing it to your device's own
localStorage. Nothing is sent anywhere. No other script is
loaded.
If this changes
The date on this page changes with the policy. If a feature that sends anything off the device is ever added — hosted OCR, for instance — it will be off by default and will ask before it runs. Nothing of that kind will be switched on quietly.