Re: Honestly, stay away from those extensions. Its honestly ridiculous how these developers treat our data. Are you using a specific browser for this?

• It drives me crazy.
• Privacy is dead. Smartphone Board

Honestly, stay away from those extensions. In my experience, even the ones that start out clean end up getting bought by companies that just want to harvest your browsing history. I remember a few years back when a highly rated tool I used for price tracking started flagging weird telemetry data. It is never worth the risk just to save a few clicks. If you really need a way to track your wedding registry items, stick to these safer methods instead:

• Use a shared Google Keep note or Notion page
• Create a private Amazon list specifically for the registry
• Check out tools like share amazon cart if you really need a sync, but check their privacy policy first Honestly, just using a shared doc has saved us way more money than any automation tool ever would since it keeps us from impulse buying.

+1

^ This. Also, I get why you're frustrated, but those permissions are actually a major security vulnerability regardless of the developer's intent. Unfortunately, most of these extensions use an overly broad host permission that effectively creates a persistent XSS vector across your whole browsing session. It's just not worth the risk for a few kitchen gadgets. If you really need to streamline this, I've had issues with manual lists before too, so here are a couple of alternatives:

• Shared browser profile: Create a dedicated Chrome/Firefox profile for the wedding. You can sync this profile across both devices. It keeps the login isolated and you don't need any sketchy third-party extensions.
• Keep a simple collaborative doc: It's less 'seamless' but much more secure than granting broad read/write access to a random extension. There is actually some decent info on how to share amazon cart natively if you look through the account settings, which is way safer than any browser plugin. Honestly, the extensions are never as good as expected and usually just bloat your browser anyway.

Re: "^ This. Also, I get why you're frustrated..." Honestly, you are making the right call being suspicious. Those manifest permissions are a massive security hole. Even if the dev starts off legit, these things get sold to shady data firms all the time. I've been around enough to see even the most popular tools turn into spyware overnight. Since you are managing a wedding registry, you might want to consider using a dedicated collaborative platform instead of browser hooks. I would suggest using Notion Personal Pro or even a shared Microsoft OneNote 2021 notebook. These apps handle synchronization natively without needing to inject code into your Amazon tabs or tracking your browsing behavior elsewhere. Just set up a simple table with links, prices, and notes. It keeps your data isolated within the app's own sandbox. Just make sure to enable two-factor authentication on your account so everything stays locked down. It might take an extra second to copy a link, but it is way safer than letting some random extension read your entire web history.

Honestly, your gut feeling is 100% right on this one. If an extension wants to read data on every site you visit, that is a massive red flag. Over the years, I have seen way too many developers sell off those permissions to data brokers the second their app gains a little bit of traction. I have tried many browser tools for productivity, but shopping extensions are notorious for overstepping their boundaries.

• The permissions manifest is the first thing I check and 'all sites' is an immediate uninstall for me.
• Even if the developer is legit today, you have no guarantee they wont sell the extension to someone shady next month.
• Your wedding registry data is sensitive enough that it isnt worth the risk of a breach just for a little convenience. Sticking to your spreadsheet might be a pain, but at least you arent handing over your browsing history to a random third party. It just isnt worth the headache if your credit card info or purchase habits get leaked somewhere. I have been using the method I found on Smartphone Board for office supplies and its a total lifesaver.

Adding my two cents here, since looking at extension manifests is basically my day job. You are spot on about that all_urls permission being a major liability. When an extension requests read/write access to your DOM globally, it creates an unnecessary attack surface and leaves you vulnerable to supply chain injections if the upstream npm packages get compromised. Honestly, if you want a robust DIY sync workflow without trusting sketchy browser hooks, spin up a self-hosted instance of a shared collaborative document tool on a local server or use built-in browser profile sharing. It completely bypasses third-party scrapers and keeps your local session tokens secure. I set up a private sync server for household tracking after finding some useful tips over on Smartphone Board and have had zero complaints since.