What the Sync extension can see

The Sync extension runs in the same browser as your bank, so it’s fair to ask what it can see. In short: your clicks and your statement files, and nothing you type.

What it never reads#

Anything you type, on any page. When recording, it notes only which buttons, links and dropdown options you click. It skips text boxes, and it ignores everything inside a form with a password box, so your login is never touched.

Your bank password stays between you, your password manager and your bank.

What it keeps, and where#

Kept in your browser, on your computer:

• your import token;
• the recorded clicks and login page for each site;
• which bank account goes into which Budget Smugglers account.

Held in memory only: a statement waiting for you to match its accounts. It’s gone when you restart the browser.

What it sends#

Statement files, to Budget Smugglers. They go through the same import as a file you upload yourself, so duplicates are skipped the same way. Each import is marked as coming from the extension and recorded in the audit log.

Your recorded steps aren’t sent anywhere, unless you choose Share to turn them into a recipe. Names, numbers and amounts are taken out first, and you see it before you copy or send it.

Where it runs#

Only on sites you’ve added, plus Budget Smugglers itself. When you add a site, the browser asks you to allow that one site. Remove a site in the extension’s settings and it stops running there.

On Budget Smugglers, a small script lets the Import page talk to the extension for Bulk sync. It can list your sites and start or end a bulk sync. It never sees your import token or your statements.

Permissions it asks for#

Permission	What it’s for
Sites you add	Recording and replaying your export, and picking up the file. Asked one site at a time.
Downloads	Spotting a statement you’ve just exported, so it can be imported.
Debugger	Moving the real mouse during Sync now, so menus that open on hover work.
Notifications	Telling you how a sync went, or when it needs you.
Tabs and tab groups	Opening each bank in its own tab for Bulk sync, grouped together.
Storage	Keeping your token, steps and linked accounts in the browser.
Identity	The Connect approval window.
Scripting	Running on the sites you’ve added.
Web requests	Some banks send a form to make the export file. The extension holds that form for two minutes so it can fetch the file again.

The debugger is used only in the bank’s tab, only while your recorded export replays, and released as soon as it’s done. While it’s attached the browser shows a “started debugging this browser” bar.

The import token#

Connecting gives the extension an import token that lasts a year. It can:

• upload statements into pools where your role can import (editor or above);
• see the names of your pools and the accounts it can import into.

It can’t read your transactions, budgets or anything else, and it can’t change anything apart from adding statements. The token is listed under Settings › Connections › API tokens as “Sync extension”, with when it was last used. Revoke it there and the extension loses access straight away.