RunJS — Privacy Policy
RunJS is local-first: your scripts and preferences stay in Chrome storage on this device by default. We do not operate a backend for your library, do not upload script bodies or page contents to our servers, and do not include analytics or ads. Optional Google Drive sync (off unless you enable it) stores library copies in your Google Drive app data under your Google Account—not on RunJS servers.
Data we store
The following is stored in Chrome storage on this device (optional Drive library copies are listed below and under Network):
- Script library entries (name, URL, CSS/JS, run settings, optional cached icon)
- Language, theme, and font preferences
- Unsaved Dashboard draft while you edit (session storage; cleared when the browser session ends)
- Short-lived inject jobs while a tab is opening (session storage)
- Short-lived inject result for the popup badge (local storage)
- Whether you dismissed the toolbar pin tip (local storage)
- Optional Drive sync state on this device (enabled flag, linked Google account email, last sync time / error) — library copies live in your Drive app data when sync is on
Data we do not collect
- No upload of your scripts, URLs, or page contents to RunJS servers (optional Drive sync uses Google’s APIs and your Google Account only)
- No analytics SDKs, advertising trackers, or sale/sharing of personal data
- No broad browsing-history collection — tab URLs are checked only for tabs tied to a RunJS run (including reusing an already-open matching tab) to decide when injection should run
- No remote script downloads — only code you saved locally is injected
Network use
- Opening or testing a target URL uses normal browser navigation to that site (not proxied through us)
- List icons first use Chrome’s local favicon cache (`favicon` permission). With site access, the extension may also fetch from the target site: read page HTML for `rel=icon`, then common root favicon paths; responses are validated as images. Without a usable cache or access, a built-in default is used (no third-party icon services)
- Optional Google Drive sync: Google OAuth and Drive API calls to read/write library files in your Drive application-data folder (per-script files plus an index). Traffic goes to Google, not to RunJS. You can disconnect or switch back to local-only anytime
Import & export
- Export writes a plain JSON backup to a file you save — treat it like your library; it is not encrypted by default
- Import reads a JSON file you choose and merges it locally; nothing is sent to us
Permissions
- storage — save your library, preferences, and short-lived inject status on this device
- userScripts — run CSS/JS you authored (enable Allow User Scripts on this extension’s details page; Chrome 138+)
- tabs — open target URLs and inject on the matching tab
- webNavigation — detect page load, redirects, SPA navigation, and iframe frames for injection
- windows — use a hidden window when validating a target URL
- contextMenus — toolbar-icon menu items to open the Dashboard and the public RunJS product page
- optional host access — requested when saving inject code or from the Permissions tab; you can still save if you decline — injection needs the grant; also used to refresh list icons from the target page when Chrome’s cache is missing
- identity / identity.email — optional Google sign-in for Drive sync (show linked account email; unused when sync stays local-only)
- alarms — schedule periodic Drive sync while sync is enabled
Scripts you write
Injected CSS/JS is provided by you, stored locally, and executed in Chrome’s user-script environment. You are responsible for what it does on sites you choose.
Contact
For privacy questions about this extension, email amals.chrome@gmail.com or use the Support / contact options on the RunJS Chrome Web Store listing.