Split for Hacker News Privacy

Manual by default

What a discussion lookup processes

When you open the extension popup, it reads the active page URL and, if present, the URL in that page’s canonical link. Before a search, it removes fragments and recognized tracking parameters and rejects private, local, special-use, credential-bearing, or apparently secret-bearing URLs. Eligible public URL candidates are sent over HTTPS to Algolia’s public Hacker News Search API and checked locally for an exact match.

The extension does not read the article body, forms, messages, or other page content. Algolia is the only third party that receives lookup candidates from the extension and may process ordinary connection metadata under its own privacy policy.

Filtering rejects recognized secrets and private addresses; it cannot guarantee that every eligible public URL is anonymous.

User control

Optional and explicit entry points

Storage and retention

What stays in Chrome

The automatic-badge, side-panel-follow, and Hacker News story-click settings are stored in chrome.storage.local. Time-bounded lookup results, selected side-panel content, and article-to-discussion tab associations use chrome.storage.session, which Chrome discards when the browser session ends. Found URL lookups may be reused for one hour and not-found lookups for ten minutes; failures and restricted pages are not added to that cache. The extension does not create a persistent browsing history.

Real Hacker News, embedded

How the side panel works

The side panel embeds the real news.ycombinator.com discussion. Hacker News receives ordinary request metadata and any cookies the browser allows for that embedded request; cookie behavior need not match a normal tab. The extension does not read the framed page, its cookies, or your Hacker News session.

Hacker News normally blocks framing. While the panel is open, the extension temporarily removes X-Frame-Options, Content-Security-Policy, and Content-Security-Policy-Report-Only headers from Hacker News sub-frame responses. The rule is installed when the first panel connects and removed after the last panel closes, never affects top-level Hacker News pages or another domain, and does not read, block, or redirect requests. Because Chrome cannot scope this rule to one extension frame, the temporary exception applies to any Hacker News sub-frame in that browser profile while a panel is open. Removing the full CSP headers also removes Hacker News’s script restrictions and report-only policy inside those frames.

Each panel can retain up to three recent HN documents in memory for faster return. Extension code does not read their DOM, cookies, focus, or scroll position. Closing or reloading the panel, a reconnect, eviction, extension update, or browser memory pressure can discard them; scroll restoration is best effort. This is separate from session lookup metadata.

Documented capabilities

Why the extension asks for permissions

Chrome permissions support reading eligible tab and canonical URLs after the relevant action, running the short-lived canonical-link check, storing settings and session state, adding the one context-menu item, opening the side panel, and applying the temporary Hacker News sub-frame rule. The tabs permission also supports automatic URL checks only after opt-in; the scripting permission supports the optional HN story-click handler in Chromium builds. Host access is limited to Algolia’s Hacker News API and Hacker News itself. Firefox uses Sidebar instead of the sidePanel permission and omits the story-click handler. The complete permission-by-permission explanation is maintained in the canonical policy linked below.

Your choices

Control and contact

Keep all available automatic settings off to use manual lookups only. Uninstalling the extension removes its local storage. Privacy questions can be sent to me@maximtop.dev or reported through GitHub Issues.