PowerUpSkool Privacy and Permissions: What the Code Declares and Does

PowerUpSkool’s inspected manifest declares the storage and tabs permissions, plus host access to https://www.skool.com/*. That is the technical baseline, not a blanket privacy guarantee. The independent extension combines local work with license communications, aggregate snapshots, and AI assistance. Evaluate each flow separately rather than reducing everything to “data never leaves the browser,” which would not accurately describe the implementation.

What the manifest declares

storage supports extension state; the code uses it for the license, device identifier, settings, and history, among other data. tabs supports tab-related operation, such as communicating changes to an open tab. The content script matches www.skool.com pages, runs after initial loading, and does not run in all frames. The manifest does not list cookies or history permissions. Their absence does not mean that accessible content on a Skool page cannot contain personal information or that every feature is entirely local.

What leaves the browser by feature

• License: validation sends the key, device identifier, a browser-based label, and, when applicable, the community identifier and label.
• Snapshots: when the capability is enabled, license, device, and community identifiers are sent with aggregate counters.
• AI: a request sends the task, language, and excerpts to PowerUpSkool’s service, plus license and device data.
• The inspected fetch requests use credentials: omit; that does not mean their request bodies are empty or anonymous.

The specific AI precaution

The current implementation constructs excerpts with authorship and post fragments. It therefore does not support an absolute “no names or personal data” promise, even where interface wording suggests that. Do not run requests on personal or confidential content or assume an automatic anonymization filter. Also distinguish local history, which can store author names, from aggregate snapshots transmitted for other features. These are different processing activities, not one interchangeable category of anonymous data with a single storage or transmission rule.

Hypothetical example: review before deployment

A manager evaluates the extension for her team. She first reviews the manifest and tests the panel with synthetic content. Then she documents required features, who may export, and whether counter synchronization is permitted. She leaves AI out of the workflow while she cannot ensure an appropriate context without personal data. Finally, she compares her questions with the privacy policy and requests clarification about discrepancies. She does not turn this review into a claim of automatic compliance or absolute security.