Trust
Is Blurr safe to install?
Chrome will warn you that Blurr can read and change your data on every website. That warning is real, and it is the honest cost of an extension that blurs whatever page you happen to be on. Here is every permission it holds, what each one cannot do, and where each piece of your data actually lives.
Updated August 2026 · Reconciled against the extension source, not written from memory.
The short version
- 1
Blurr is a Manifest V3 Chrome extension that hides content by applying a CSS blur inside your browser, on the page in front of you.
- 2
It requests access to all websites because a blur has to run on whatever page you are on, and no extension can know that page in advance.
- 3
The blurs you draw and the list of pages you blurred are stored in
chrome.storage.localon your own device and are never uploaded, signed in or not. - 4
Blurr takes no screenshots, sends no page content or page URLs to any server, and contains no third-party analytics, advertising or tracking code.
- 5
Signing in is optional and syncs only your saved rules and preferences, so your Auto Blur settings, Blur Text keywords and Tab Privacy default follow you to another computer.
And the part most privacy pages leave out: a blur is a visual layer over content that is still in the page, so it stops onlookers and recordings, not someone at your own keyboard. The honest limit of a blur.
Permissions
Every permission, and why it is there
This is the complete list from Blurr’s manifest, nothing added and nothing left out. The third column is the one that matters: a permission is only reassuring once you know its ceiling.
Swipe the table sideways to read every column.
| Permission | What it enables | What it does not allow |
|---|---|---|
<all_urls> Access to the sites you visit host_permissions | Blurr runs on the page in front of you: it draws the blur you asked for, restores saved blurs before the page paints so nothing flashes into view, and lets Auto Blur and Blur Text catch content as it loads. A blur has to work on whatever page you happen to be on, and no extension can know in advance which page that will be, so the permission has to cover all of them. | It does not send a page anywhere. Every scan runs in your browser and stops there: no page URL, no page text, no HTML and no screenshot is transmitted. Blurr adds nothing to a page except its own overlays and stylesheet. |
scripting Inject the blur toolbar and re-apply blurs permissions | Lets the background service worker put the blur toolbar into the tab you are working in and re-apply your blurs on demand, for example after you press the keyboard shortcut or change a rule. | It reaches web pages only. It cannot run code outside the browser, cannot touch another application, and Chrome blocks it on its own pages such as the Web Store and chrome://settings. |
activeTab The tab in front of you, when you ask permissions | Grants access to the current tab at the moment you click the Blurr button or press the shortcut, which is how the popup knows what it is acting on. | It is granted by your gesture and it expires. It does not extend to your other tabs, and it does not survive that tab navigating somewhere else. |
tabs Tab titles and favicons permissions | Lets the popup tell you which site a rule would apply to, and lets Tab Privacy replace tab titles and hide favicons so a glance at your tab strip during a call reveals nothing. | It carries no page content: Chrome hands over a title, a URL and a favicon, never the document. Blurr keeps all three on your device and sends none of them to a server. It is not history access, which Blurr does not request. |
storage Save your blurs and settings permissions | Writes your blurs, your saved rules and your preferences to chrome.storage.local, the extension’s own private store on your machine. | It is not localStorage and not a cookie. No website can read it, no other extension can read it, and it gives Blurr no access to anything a site has stored about you. Uninstalling removes it. |
identity The optional Sign in with Google button permissions | Runs Google’s own sign-in flow when you choose to create an account, asking for three scopes: openid, your email address and your basic profile. | It does nothing at all until you press sign in. The scopes do not reach your Gmail, Drive, Calendar, contacts or files, and signing out revokes the tokens, which live only on your device. |
alarms A six-hour timer permissions | Wakes the service worker roughly every six hours to refresh your subscription status and the current prices, so the popup is never stale. | A timer and nothing else. It carries no data, sees no page, and cannot start anything Blurr is not already allowed to do. |
Blurr also registers one content script at
document_start
in every frame. That is what blocks the first paint until your saved blurs are back, so
sensitive content never flashes on screen for the half second before the page settles.
Data map
Where each kind of data lives
Five places, in order of how much of your data is in each. The first one holds almost all of it, and it is your own machine.
On your device
chrome.storage.local, never localStorage
- Every blur you draw: its position, size and intensity, plus a small technical snapshot of the element (a selector and a short text fragment) so the blur can find its place again after a reload.
- The list of sites and pages where you placed blurs.
- Your Tab Privacy per-tab pins and your chosen tab-title disguise style.
- Your sign-in tokens, if you signed in. Signing out revokes them.
None of this is uploaded, synced or shared, whether you are signed in or not.
In your account, only if you sign in
Sign-in turns sync on, not Premium
- Your Auto Blur configuration, your Blur Text keyword rules and the sites or pages those rules apply to.
- Preferences that should follow you: theme, reveal on hover, and the global Tab Privacy default.
- What Google returns at sign-in (your email address, name and profile picture) and your subscription status.
Your drawn blurs and the list of pages you blurred never sync. An account is optional, and this is a roaming copy: chrome.storage.local stays the live source of truth.
On our own server
Anonymous product events, deleted after 180 days
- A short, fixed list of first-party events such as installed, blur created, paywall viewed and checkout started, tied to a random install identifier.
- A one-way hash of technical browser characteristics, sent only when you sign in, used only to stop one browser farming free allowances across many accounts.
These events never include a page URL, page content or anything you blurred, and there is no third-party analytics SDK inside the extension.
With Stripe
Only if you buy Premium
- Checkout happens on Stripe’s own pages. Blurr never sees or stores your card number.
- We keep your plan, subscription status and dates, currency, and Stripe’s customer and transaction identifiers.
Stripe passes back the name and billing address you entered so we can email your receipt.
With Google
Only the sign-in itself
- The optional OAuth sign-in flow, with the openid, email and profile scopes.
Google is not given anything about your blurs, your rules or the pages you visit.
The full legal detail, including retention windows and how to have your account deleted, is in the privacy policy.
Boundaries
What Blurr never does
Every line here is checkable. Open the permission table above, or the manifest inside the installed extension, and see for yourself that the permission it would need is missing.
Take a screenshot or capture your screen
Blurr holds neither tabCapture nor desktopCapture. It cannot see a pixel of your screen; it only writes CSS into the page.
Upload the pages you visit
No page URL, no page text and no HTML leaves your browser. Auto Blur and Blur Text scan the document on your machine and the result stays there.
Read or write cookies
The cookies permission is not in the manifest, so Chrome would refuse the call even if the code tried.
Read your browsing history
The history permission is not requested. Blurr knows the tab you are on because you opened it in front of Blurr, and it keeps that to itself.
Touch your clipboard, downloads, bookmarks or location
None of those permissions are requested, and none of those APIs are reachable without them.
Run code fetched from the internet
Manifest V3 forbids remotely hosted code. Every line Blurr executes ships inside the package Google reviews, including the demo photos in the welcome tour.
Load an ad, analytics or session-recording SDK
There is no third-party script of any kind inside the extension. This claim is about the extension; the website is a different story, told below.
Sell, rent or share your data
There is no data broker in this product and no advertising business behind it. Blurr is paid for by the people who buy Premium.
Full disclosure
The website is not the extension
Plenty of privacy tools say "no trackers" and quietly mean the product, not the marketing site. Ours means the extension. This website, blurr.ing, does run analytics, and it is better that you hear it here than find it in a network tab.
Ahrefs Analytics
Cookieless. It counts pages and referrers in aggregate and stores nothing on your device, which is why it runs without asking. It is on this page right now.
Google Analytics
Sets cookies, so it loads only after you choose Accept in the cookie banner. Reject it, or simply never answer, and the script is never fetched at all. Change your mind any time with Cookie settings in the footer.
The line to hold onto: neither of those tags exists inside the extension. Installing Blurr does not put Ahrefs or Google Analytics anywhere near the pages you browse. They run on this marketing site only, and they never see anything you blurred. If you join the launch waitlist we also store the email you type, the page you typed it on, your country and your browser’s user-agent string, and nothing else.
Threat model
The honest limit of a blur
Blurr is very good at one job and cannot do three others. Knowing which is which is the difference between a tool that protects you and a tool you over-trust.
What it does protect
Anyone looking at your screen, your screenshot, your recording or your live stream. They receive pixels, and a blurred region gives them nothing to recover. This covers the overwhelming majority of the ways private data actually leaks: the wrong tab on a call, an autofilled form in a demo, a dashboard in a slide.
A blur is a visual layer, not access control
The text is still in the page underneath. Anyone sitting at your keyboard can switch the blur off, or open developer tools, and read it. The optional Block clicks setting makes blurred content inert so it cannot be clicked, selected or copied by accident, which is a useful guardrail and still not a lock. If the goal is that a person with your laptop cannot read something, the answer is not to display it.
It stops at the edge of the browser tab
Blurr cannot blur your desktop, your terminal, your IDE, a PDF viewer or a Slack window. If you share your entire screen, everything outside Chrome is still visible. Sharing a single tab rather than the whole desktop is the habit that pairs with this.
Cross-origin frames can only be covered whole
An embedded widget served from another domain, such as a payment field or a third-party chat, is walled off from every extension by the browser itself. Blurr cannot reach one element inside it. You can still blur the entire frame as a single block from the page around it. Same-origin frames, at any depth, work normally.
Disclosure
Reporting a security issue
If you find something that lets Blurr be used against the person who installed it, we want to hear about it before anyone else does.
Write to us
Email [email protected] with the word Security in the subject. Include what you did, what happened, and the extension version if you have it. A person reads every one of these.
What we will do
Confirm we received it, tell you what we found, and ship the fix. Please give us a reasonable window before publishing, and please do not test against other people’s accounts or data. We are glad to credit you in the release notes if you would like.
What we are not claiming
Blurr carries no third-party security audit, no penetration test report and no compliance certification, and you will not find a badge for one on this page. It is also a privacy safeguard rather than a compliance product: it is not a GDPR or HIPAA control, and we sign no business associate agreements. What we offer instead is that everything Blurr can possibly do is bounded by the permission list above, Chrome shows you that same list before you install, and this page explains every entry on it.
FAQ