Every permission the PullThisCard Chrome extension requests, and exactly what it's used for. Nothing here is aspirational — this describes what the shipped code actually does.
The extension watches for signals that you've reached a checkout step on a shopping site (a Shopify checkout flag, a recognized store domain, page metadata suggesting a store name), and when it finds one, shows a small banner recommending which card in your wallet to use. That's the entire feature. It does not track your browsing history, does not run on a schedule in the background beyond this, and does not communicate with any server other than PullThisCard's own API.
Checkout pages exist on thousands of individual merchant domains — there's no fixed, enumerable list of "shopping sites" Chrome permissions could scope this to. The extension's content scripts are written to be inert almost everywhere: each detection method (a platform-specific signal like Shopify's checkout object, a curated list of known store domains, or a last-resort read of the page's own site-name metadata) requires a specific match before doing anything at all. A page with none of these signals — the overwhelming majority of the web — is not acted on; the script runs, checks, and does nothing further.
As of version 1.3.0, detection also runs inside embedded iframes on a page (all_frames: true), not just the top-level document — some real checkout flows genuinely load inside a nested iframe (an embedded payment step, a hosted-checkout widget). The recommendation banner itself is still only ever rendered in the page's own top frame, never inside a nested iframe, so it's always sized and positioned correctly.
Used to know which browser tab a checkout was detected in, so the toolbar icon's badge (a small checkmark) can be shown on the correct tab. Also used by the popup to read the current tab's URL when you click the extension icon manually. Does not grant access to tab content, browsing history, or other tabs' data beyond URL and title.
Used to remember extension-local state on your device — a local mirror of your card wallet so the popup can show a recommendation without a round trip. (Dismissing a recommendation banner just closes it for that page view; the dismissal itself isn't written to storage or remembered after you navigate away or reload.) This is standard Chrome extension local storage, not a cookie, and is not synced to any PullThisCard server beyond what's described below.
Lets the extension call PullThisCard's own recommendation API directly, and lets the extension and the PullThisCard web app exchange messages (e.g. to keep your wallet in sync between the extension popup and the website) via Chrome's externally_connectable mechanism. Scoped to PullThisCard's own domain only — not a grant of access to any other site.
The broadest-looking grant, covered in detail above — required because checkout detection has to be able to run on any merchant's domain, not a fixed list. See "Why it asks to run on every website."
Never reads credit card numbers, card art, or any payment form field values.
Never reads passwords, login fields, or authentication tokens on any site.
Never collects general page content, analytics, or browsing history beyond the specific checkout-detection signals described above (a platform flag, a domain match, or page metadata like the site name).
Never runs analytics or tracking of any kind, first- or third-party. There is no analytics SDK in the extension.
Never shows the recommendation banner anywhere except a page it has positively detected as a checkout step — it does not appear on ordinary browsing, search results, or product pages.
When a checkout is detected, the extension sends a request to PullThisCard's own API containing: the cards in your wallet (by name, e.g. "Chase Sapphire Preferred" — never a card number), the merchant or spending category detected, and your selected country. This is the exact same data the main web app sends to calculate any recommendation — the extension doesn't collect or transmit anything the website itself doesn't already. Full detail on what's sent and why is in the Privacy Policy.
Page last reviewed: July 2026, against extension version 1.4.0.