A Chrome permission and collecting data are not the same thing. Here is what the current Flash Route build does.
A Chrome permission and collecting data are not the same thing. Chrome shows capabilities an extension receives for its job; it does not mean every available datum is collected or stored.
CapabilityWhy Flash Route needs it
proxy — Chrome route settingsUsed to enable a separate route for selected services and disable it on the user's command.
storage — Chrome storageKeeps service choices, access state, and temporary technical data needed to reconnect.
alarms — background schedulingKeeps access refreshed, checks expiry, and helps recover after Chrome sleeps.
declarativeNetRequestWithHostAccess — protection rulesHelps prevent a selected service from silently switching to the normal connection when its secure route is unavailable.
webRequest and webRequestAuthProvider — route authenticationUsed to answer a service authentication request from the selected route. It does not give the extension a right to read page text.
sidePanel — side panelOpens the built-in diagnostic and support panel.
host_permissions: <all_urls> — technical routing scopeChrome shows broad technical access because route rules apply to browser requests and the extension answers service route-authentication requests. This is the scope of technical rules, not permission to read page content.
privacy — optional WebRTC protectionThis optional permission is requested only when the user enables that setting.
What happens to data
Inside Chrome
Settings, selected services, access state, device ID and name, and temporary route data are stored. If you sign in or pay for access, the entered email, current session data, and an unfinished payment state can be stored locally. A technical installation attestation may be kept for the free period and may use Chrome Sync when sync is enabled.
At the control service
An email address is sent to the server when you choose to sign in or obtain access. The service also processes device ID and name, extension version, access state and expiry, plus session and payment dates. OTP codes and activation keys are stored in server records as hashes, not in plain text.
At a route node
The node receives the connection and the temporary authentication data it needs. In the current configuration it forwards protected HTTPS connections without decrypting their content, and the standard Squid access log is disabled. Operational system logs are described separately: this setting does not mean that no technical logs exist at all.