Browser Extension — Privacy

Version 3 · Last updated on 2026-10-10

---

Part A — What the extension sends, in plain terms

The Buboflash extension lets you select a passage on any webpage and turn it into an annotation or a flashcard, shows you the highlights you made when you come back to that page, and lists them in a side panel beside it.

To show you your old highlights it has to ask our server "do I have anything for this page?" — and to ask that, it has to tell the server which page you are on. That is the whole privacy trade, and everything below is detail on it.

1. The switch is real

Annotations in tabs is a checkbox in the extension's popup. The toolbar icon shows its state: crossed out when it is off or you are not logged in, plain when it is on.

When it is off — or when you are not logged in to Buboflash — the extension sends nothing about your browsing. Not the URL, not the page, nothing. It does not even load itself into the page: with the switch off no script is injected into any tab, so there is nothing running there to send anything.

What it still asks our server, switched off, is whether you are logged in, and — when you open the popup — for a summary of your learning and your Annotations from choice (§ 5). None of these says anything about the page you are on.

This is a gate in the code and not a promise about intent. It is checked every time the extension is about to send a page's address, creating something included.

2. When it is on, and you are logged in

The address of every page you open is sent to the Buboflash server, apart from the pages in § 4. It is sent when the page loads, for two questions:

1. Can this page be annotated at all? — some pages are excluded (see § 4).
2. What do you have on this page? — your annotations and flashcards on it, so that they can be highlighted.

The second question is asked again while you use the page: when you come back to its tab (at most once every three seconds), after you create or change something there, when the page moves to a new address without reloading, and when you change Annotations from. The address also goes with everything you create or re-attach on the page (§ 3), and when you switch the selection bubble off or on for its site (§ 5).

The page itself is not sent. We send the address; the server answers with your own annotations for it; the extension then finds the matching passages inside your browser and highlights them there. The server never sees the text it is highlighting, and asking about a page never makes our server fetch it.

So if you open your bank, your medical records or your employer's intranet with the extension on, what reaches us is the address of the page and nothing that is on it. That holds even if somebody else has maliciously created an annotation on a page with the same address — the matching happens in your browser, and the annotation text is theirs, not your page's.

But an address is not nothing. https://example-clinic.co.uk/results/appointment-confirmed tells a reader a great deal without a single word of the page body. Please read § 3 and § 8 with that in mind.

3. When you actually create something

Creating an annotation, a flashcard or an occlusion card from a selection sends us, in addition to the address:

• the text you selected, and its HTML;
• a flashcard's other side, if you typed it or selected it on the page;
• a short window of the surrounding page — at most 256 characters before your selection and 192 after it — so the passage can be located again if the page changes, and so its context can be shown, for instance in search results. The count includes the page's markup, so the text in a window is usually a little shorter. It is the page's text as written, which can include words the page does not display, such as labels meant only for screen readers;
• which occurrence it is, if the same text appears several times on the page, and how many occurrences there are.

An occlusion card made inside a passage sends that passage as well — the part you selected first, with the words you blanked out marked in it — and a second window around it, bounded the same way. Re-attaching an annotation to a different passage sends the new passage and its window in the same way.

Those windows are the only page content we receive that you did not select yourself, and they are bounded. We do not receive the rest of the page. What our server does with a page you annotate — it fetches the page from its site and keeps the text it extracts, so that your material can be searched — is in the Privacy Notice § 2f.

4. Pages the extension will not touch

These are decided in your browser, from the address alone, so their addresses are never sent:

• Buboflash's own pages. You do not need the extension there.
• A search engine's results page on Google, Bing, DuckDuckGo, Yahoo, Yandex, Baidu, Ecosia, Startpage, Brave Search or Kagi, because its address carries what you searched for. The engines' other pages are treated like any page.
• mail.google.com, whose addresses identify your messages. Our server refuses it as well.
• Anything that is not http: or https: — local files, browser settings pages, extension pages.

5. Your settings — and the ones that are not local

Stored in your browser, per browser (so you can have the extension on at home and off at work): the Annotations in tabs switch itself, and your keyboard shortcuts, which you set in the browser's own extension settings. While the browser is open the extension also keeps a few working notes there — whether you are logged in, and which tabs it is working in — which the browser clears when it closes.

Stored on your Buboflash account, shared across every browser:

• Annotations from, which chooses whose annotations you see;
• how long a highlight's popup stays open after the pointer leaves it, which is one of Buboflash's own settings;
• the sites on which you have switched the selection bubble off. The bubble is the small bar that appears when you select text, and the popup lets you switch it off for the site you are on. To remember that, our server keeps the site's name — en.wikipedia.org, never the rest of the address — with your account until you switch it back on there. On such a site you can still create from the right-click menu or the keyboard.

6. The side panel, the popup and our website

The side panel lists the annotations on the page in the tab beside it — the same ones that are highlighted there, which the extension already holds — so opening it sends nothing more about the page than a request for the page's tags, by our own number for that page.

The popup shows what the extension knows about the page in front of you only while the switch is on and you are logged in. With the switch off it shows only a summary of your learning, with no connection to the page you are browsing.

Our own website can ask whether the extension is installed, so that it stops offering it to you. No other website can.

7. What the page you are reading can see

The extension's highlights and controls are drawn inside the page you are reading, and that page's own scripts share the browser window with them. We keep our controls sealed off from the page's code as far as browsers allow, but some things cannot be hidden from it:

• Your highlights. They are marks in the page's own text, so the page can see which passages you have highlighted on it, and our number for each.
• What you type over it. While you type into the extension over a page — a flashcard's question or answer, an edit to an annotation — the page can see the keys you press. If that matters on a page, create the card and finish it on the Buboflash website instead.
• The pictures and sounds in your cards. Those shown over a page are loaded by that page, so it can see where they are on our server, and open them. Our server keeps no record of which page they were shown on.
• Text you select inside a card shown over the page, in some browsers.

8. Please do not install this at work or school

Sending the address of every page you open to an outside server is almost certainly against your employer's or your school's policy, whatever the server does with it. You may also get buboflash.com blocked by whoever runs the firewall, which would be a bad outcome for both of us.

If you want to learn from something at work, use buboflash.com directly. Nothing in the extension is unavailable there.

9. What happens to the addresses afterwards

Nothing, unless you create something on the page — its address then becomes part of what you made — or switch the selection bubble off for its site (§ 5). The address is removed from our server's request log before the log is written, and the log itself is deleted after 14 days; what it keeps is that your extension asked, when, and for which account. The one exception is a failure: if our server fails while answering your extension about a page, the record of the failure, which we keep in order to fix it, can include that page's address. It is deleted with the other logs, after 14 days. Apart from that, we keep no record of your browsing. The Privacy Notice § 5 and § 8 give the detail.

10. Where else to look

• Privacy Notice — the whole service, not just the extension.
• Terms of Service
• Your Freedom Matters

---

Part B — Chrome Web Store submission details

Single purpose

Annotating webpages for learning: the user selects a passage on a webpage and turns it into an annotation or a flashcard, and sees the annotations they made earlier highlighted on the page and listed in a side panel.

Annotations, flashcards and the learning schedule are managed by the https://buboflash.com backend service, which the extension's author also wrote.

Permission justification

scripting

The extension injects a content script that highlights the user's earlier annotations in the page, shows an annotation in a popup when its passage is hovered or clicked, and offers a small bar at a text selection for creating an annotation or a flashcard from it.

The content script is injected only if the Annotations in tabs checkbox is enabled, the user is logged in, and the backend server confirms the page may be annotated. Users enable and disable this in the popup. If it is disabled there is no content script, and the popup shows only a generic learning summary from the server with no connection to the page being browsed.

This is explained at https://buboflash.com/bubo5/tal-static-fullscreen-forall/annotations-privacy, linked next to the checkbox in the popup. That page also discourages enabling the extension at work and suggests using https://buboflash.com directly instead.

contextMenus

On selected text the right-click menu offers Annotate the selection and Flashcard from the selection…; on a highlighted passage, Open annotation and Open annotation in new tab; and Buboflash: side panel opens the side panel. The creation items are shown only while Annotations in tabs is enabled and the user is logged in.

storage

Whether Annotations in tabs is enabled is stored locally in the browser. Working state that must survive the background worker being stopped — whether the user is logged in, which tabs the extension is active in — is kept in session storage, which the browser clears.

Three preferences reachable from the extension are not local: they are account preferences stored on the Buboflash server, as they are also settable on the website — Annotations from, which chooses whose annotations are displayed; how long an annotation's popup stays open; and the sites on which the user has switched the selection bar off.

tabs

The extension needs access to:

1. the tab's URL, to ask the server whether that page already has annotations;
2. the tab's content in the browser, to attach annotations retrieved from the server to text passages on the displayed page — this matching is local processing and the page content is not transmitted;
3. the passage the user selects, which is sent to the server when a new annotation or flashcard is created, together with at most 256 characters of preceding and 192 characters of following page text so the passage can be located again if the page changes, and so its context can be shown, for instance in search results.

If Annotations in tabs is unchecked, or the user is not logged in, the extension injects nothing into tabs and sends nothing about them; it only notices when a page of the Buboflash site loads, to learn whether the user has logged in or out there.

sidePanel

The side panel lists the annotations on the page in the current tab — each with its passage, its flashcards and how far they have been learned — beside the page itself, and clicking an entry scrolls the page to its passage. It opens from the toolbar popup, the right-click menu, or a keyboard shortcut the user sets, and it shows only what the extension already holds for that page.

Host permissions

When the user enables annotations in webpages and the backend server confirms that a page loaded into a tab may be annotated, a content script is dynamically injected into that tab, so that (1) existing annotations retrieved from the backend are shown in the text as highlighted passages with a popup, and (2) the user can create new annotations and flashcards from a text selection.

Before sending anything the extension skips Buboflash's own pages, search engines' results pages, mail.google.com, and anything that is not an http: or https: page; the server declines injection for mail.google.com as well.

Are you using remote code?

No.

---