Privacy Policy
No data is collected. Nothing is sent to the developer or to any third party. There is no server behind this extension, no account and no analytics. Your artwork, your library and your token stay on your own machine.
What is stored, and where
All of it is local to your browser on your computer. None of it is synchronised, uploaded or backed up by the extension.
| Plex server address | Extension storage |
| Plex token | Extension storage |
| The item you are working on, and the picture you picked | Extension storage, replaced by the next one |
| Your saved looks (“presets”) | Local storage for the Lab page |
| Lab settings — panel side, theme, text size, folders, language | Local storage for the Lab page |
| The last poster you applied, so it can be undone | Local storage for the Lab page |
| Your overlay library — the pictures you saved | IndexedDB, in your browser |
| The pieces currently on the poster | IndexedDB, in your browser |
Removing the extension removes all of it. Clearing the token on the options page removes the token on its own, and the Lab can clear its own library and its own settings from the Options window.
What is sent, and to whom
Two destinations, and no others.
-
The picture you right-clicked, fetched from whatever site
it is on, so it can be drawn on the canvas. That request is made with
credentials: 'omit'— your cookies for that site are not sent with it. Nothing is sent to that site except the request for the image itself. -
The Plex server address you entered, with your token
attached as the
X-Plex-Tokenparameter, exactly as the Plex API requires. This is where the finished poster is uploaded. The default address ishttp://127.0.0.1:32400— the same computer.
The finished cover art is composed in your browser and sent straight to your server. It does not pass through anyone else, and no copy is kept anywhere but your machine and your server.
There is no analytics, telemetry, error reporting, remote configuration, third-party script, CDN or external endpoint of any kind.
Files written to your computer
The Lab can save a finished cover, or a piece you kept, into your Downloads folder — under a folder name you choose in the Options window, or through the browser's own Save dialog if you prefer to be asked each time.
It only ever writes files that it created and that you asked it to write. It does not read your Downloads folder, does not list what is in it, and cannot reach any other part of your disk.
Your Plex token
A Plex token is authentication data and is handled as such:
- stored locally, and never transmitted to anyone but your own server;
- never written into a web page or the page's DOM;
- never displayed back on the options page once saved — the field shows only that a token exists and how long it is;
- masked while being typed, with a temporary “show” toggle;
- removed from any address the extension reports back to you, so it cannot appear in a message on screen;
- cleared in one click.
It is not encrypted at rest. This is stated plainly rather than glossed over: any key capable of decrypting it would have to be stored beside it, which would protect nothing. The protection offered is that it never leaves your machine.
Permissions
| contextMenus | The right-click items — “Set as Plex cover art”, choosing a target, and fetching a title's logo. |
| storage | The settings listed above. |
| activeTab | Reads the page you right-clicked on, on that one tab, for that one invocation — to work out which picture you meant and which item you are on. |
| scripting | Runs short functions written inline in the extension, in that page, to return what was clicked. There is no persistent content script and no third-party code. |
| downloads | Saves a finished cover, or a piece you kept, into your Downloads folder. Used only when you ask it to save something. |
| Website access | Optional. Requested at the moment it is needed — for your own server's address, and for the site holding a picture you chose. Not requested at install, and never granted silently. |
Remote code
None. No eval, no Function constructor, no imported scripts and
no CDN. Everything that runs is inside the package, including the guide, its
illustrations and every font fallback.
Children
The extension is not directed at children, and collects nothing from anyone.
Changes to this policy
If this policy changes, the date at the top of this page changes with it.
Contact
Questions about this policy can be sent through the extension's Chrome Web Store listing.