A Chrome permission and collecting data are not the same thing. Here is what the current Flash Route build does.
A Chrome permission and collecting data are not the same thing. Chrome shows capabilities an extension receives for its job; it does not mean every available datum is collected or stored.
CapabilityWhy Flash Route needs it
proxy — Chrome route settingsUsed to enable a separate route for selected services and disable it on the user's command.
storage — Chrome storageKeeps service choices, access state, and temporary technical data needed to reconnect.
alarms — background schedulingKeeps access refreshed, checks expiry, and helps recover after Chrome sleeps.
declarativeNetRequestWithHostAccess — protection rulesHelps prevent a selected service from silently switching to the normal connection when its secure route is unavailable.
webRequest and webRequestAuthProvider — route authenticationUsed to answer a service authentication request from the selected route. It does not give the extension a right to read page text.
sidePanel — side panelOpens the built-in diagnostic and support panel.
host permissions — supported services and the Flash Route APIThe package contains 26 required host origins: 25 for five supported services — YouTube, ChatGPT, Gemini, Grok, and WhatsApp Web — and one fixed Route Proof diagnostic endpoint, route-proof.flashroute.app. The diagnostic runs only from an explicit user action, is not a selectable service, does not change the selected route, and does not grant access to read page content. The Flash Route API host is optional and is requested only from an explicit sign-in or access action.
privacy — optional WebRTC protectionThis optional permission is requested only when the user enables that setting.
What happens to data
Inside Chrome
Settings, selected services, access state, device ID and name, and temporary route data are stored. If you sign in or pay for access, the entered email, current session data, and an unfinished payment state can be stored locally. A technical installation attestation may be kept for the free period and may use Chrome Sync when sync is enabled.
At the control service
An email address is sent to the server when you choose to sign in or obtain access. The service also processes device ID and name, extension version, access state and expiry, plus session and payment dates. OTP codes and activation keys are stored in server records as hashes, not in plain text.
At a route node
The node receives the connection and the temporary authentication data it needs. It forwards protected HTTPS connections without decrypting their content. Actual operational logging and retention must match the published privacy policy.