[pkacprzak]

I understand your concerns and would like to clarify any potential doubts. The client app (the extension itself) has only currentTab permission which means that it has access only the tab where user opened the extension and it takes a screenshot only when a user explicitly clicks Scan button. The source code of the extension is completely public - everyone can unpack it and verify that indeed it does exactly that. So this actually reduces to the same functionality as for example using any photo app with cloud processing - i.e. you take the photo/screenshot explicitly and no other information is sent to the server.