Browser extension privacy

Who this is for

The extension is intended for workspace administrators who already use Product Tours. It helps you point-and-click to choose elements on web pages you are allowed to configure, then save those choices as tour steps in your Product Tours workspace.

What the extension stores on your device

In Chrome's sync storage (same category as other extension settings), the extension saves only what you type in the options screen:

• Dashboard base URL — the Product Tours web app origin you use (for example https://tours.gallaghersresource.com).
• Access token — a credential you paste from the dashboard so the extension can call the same authenticated APIs as the app. Treat it like a password; revoke or rotate it in the dashboard if a device is lost or someone else had access.

If you use Chrome Sync, Google may sync this storage according to your Chrome account settings. We do not operate Chrome Sync and do not control Google's handling of synced data.

Network requests

When you use the extension, it sends HTTPS requests only to the dashboard base URL you configured. Requests use your stored access token and call Product Tours builder APIs (for example loading tours, saving steps, publishing). Those requests are processed under our main Privacy Policy as part of the Service.

The extension does not embed third-party advertising or analytics trackers and does not sell data.

Page content and “pick element”

To let you choose a target element, a content script runs on the active tab when you start pick mode. It reads the page's DOM only to compute a CSS selector and path information you asked to capture, then sends that small payload to the extension's side panel. It does not continuously scrape or upload full page HTML to us for unrelated purposes.

You should only use the extension on sites you are authorized to configure. Your organization's policies and contracts govern what you may record or change.

Permissions (Chrome)

The extension requests Chrome permissions that match these behaviors: local storage for your URL and token; side panel UI; access to the active tab when you use pick mode; scripting injection when Chrome has not already loaded the helper on that tab; and broad host access so the content script and API calls can run on the https and http origins you use. Narrowing host permissions is a possible future improvement where the store allows it without breaking legitimate customer domains.

Removal

Uninstalling the extension removes its local extension storage from that browser profile in normal Chrome behavior. Revoking access tokens and rotating credentials should still be done from the Product Tours dashboard if you believe a secret was exposed.

Contact

Questions: tours@gallaghersresource.com. Also see Privacy Policy.