Hoome for IT teams

The short version

• What it is: a Chrome extension (Manifest V3) that replaces the new tab page with a page of shortcuts, folders, instant search and optional widgets.
• Permissions: storage and unlimitedStorage, plus access to two icon services. Bookmark access is optional and only requested when a user starts an import. Signing in to a Premium account, optional too, is only requested when the user clicks “Se connecter avec Google”.
• Network: two icon services receive the domain name of your shortcuts. The weather widget, off by default, calls Open-Meteo. Nothing else leaves the machine.
• Vendor side: no account is needed, and without one the extension never contacts the publisher. The optional account only serves the Premium subscription. No sync, no telemetry, no advertising.
• Full cut off: a strict privacy mode stops every network request the extension makes, icons included.

The permissions, in plain words

Permission	What it allows
storage	Save shortcuts, folders, settings, notes and tasks in the local storage area Chrome reserves for the extension.
unlimitedStorage	Go beyond the default quota of that area: cached icons, an imported wallpaper and local backups can reach it.
bookmarks, optional	Read the bookmark tree once, to build the folders the user ticked. Not present at install time, requested on the import click, revocable from chrome://extensions. Bookmarks are never modified and never transmitted.
identity, optional	Open Google’s sign in window when the user clicks “Se connecter avec Google”, for the Premium account. Absent at install, no Chrome warning, removable from chrome://extensions.
New tab page override	Show the extension page when a tab opens. That is the whole point of Hoome.
Access to gstatic.com and icons.duckduckgo.com	Download a site icon from Google’s icon service, or from DuckDuckGo when Google returns nothing usable.

Nothing else is declared: no tabs, no history, no cookies, no webRequest, and no content script injected into the pages your staff visit. The content security policy limits execution to the code shipped in the package, so no script, font or stylesheet is fetched from the internet.

The externally_connectable key lets only https://hoome.dev pages send a message to the extension, to hand over a one time sign in ticket between the site and the extension. It triggers no warning and grants no access to the pages visited.

One point worth explaining internally: at install time, Chrome summarises the two host permissions with its generic wording, “Read and change your data on gstatic.com and icons.duckduckgo.com”. That is the standard label for any host permission. In practice, the extension only downloads images there.

The three quick access buttons

Buttons for history, downloads and bookmarks ask Chrome to open its own internal page in the current tab. That navigation does not require the tabs permission, which is what grants access to tab contents: the extension displays the browser page, it reads nothing from it. The buttons can be hidden in settings.

What leaves the machine, and where it goes

This is the complete list of addresses the extension can call on its own.

Address	When	What is sent
Google icon service (t3.gstatic.com)	When a shortcut is added, and the first time a shortcut without an icon is shown. After a failure, one retry per week at most. Never when the icon is cached, or when initials or a custom image were chosen.	The site host name, for example hmrc.gov.uk. Not the path, not the page title.
icons.duckduckgo.com	Same conditions, only if Google returned nothing usable.	The site host name.
geocoding-api.open-meteo.com	Weather widget enabled, while the user types a city name in settings.	The typed text and the interface language.
api.open-meteo.com	Weather widget enabled and a city selected: on page load if the forecast is older than thirty minutes, or on manual refresh.	The coordinates of the chosen city and the forecast fields requested.
hoome.dev	Only if the user signs in to the optional Premium account: at sign in, when opening the Account section of the settings, and when clicking “Ouvrir mon compte”. Never in strict privacy mode.	The account session token, and at sign in the code returned by Google. Never a shortcut, folder or note.

Four details that matter during a review:

• Icons are converted to small images, stored locally, and never requested again.
• No user, install or machine identifier is attached to these requests. They carry the browser’s usual headers, like any image.
• Widgets are off by default, so a fresh install only ever contacts the two icon services.
• The search bar opens the chosen engine when the user presses Enter, exactly like typing in the address bar, with no suggestion requests while typing. Geolocation is only asked for on an explicit click in the weather settings, through Chrome’s own permission prompt.

Cutting the network entirely

For a machine where nothing may leave, not even a domain name, settings offer a strict privacy mode under Data. Once enabled, the extension issues no network request at all: site icons are replaced by coloured initials, the weather widget becomes unavailable and its switch is greyed out. Signing in to the account becomes impossible, and an extension already signed in no longer contacts hoome.dev.

Icons already cached stay visible, since they are local, and a button clears them after confirmation. The mode survives an import, a backup restore or a reset to default shortcuts, so none of those actions can quietly start requests again. Everything local keeps working: backups, export, import, bookmark import.

Where the data lives

Everything is written to the local storage area Chrome reserves for each extension, on the machine. The extension does not use synced storage, so nothing travels through the user’s Google account, and nothing is sent to a server, apart from the Premium account session for users who sign in.

That area holds shortcuts and folders, settings, notes and tasks, an open counter per shortcut used to rank search results, a copy of the previous state written before each save, the last ten automatic backups, an imported wallpaper and the latest weather forecast when the widget is on. For users signed in to the account, the session is added, stored apart: never exported, never backed up.

On uninstall, Chrome wipes that storage entirely, backups and icon cache included. Nothing survives anywhere else. Without uninstalling, a settings command empties shortcuts and folders after taking a restorable backup.

To carry a setup over, the JSON export produces a file downloaded to the machine: shortcuts, folders, notes, tasks, settings, and optionally icons and wallpaper. It is sent nowhere, and imports onto another machine, which is the recommended path before a hardware refresh.

Rolling it out to a fleet

What works today:

• The extension is published on the Chrome Web Store, so it deploys through the usual Chrome policies, force install or allow list, using the item ID we provide on request.
• The package loads no remote code. The version your team reviewed is the one that runs, until the next store update.
• To standardise machines, configure a reference workstation, export the JSON file and import it on the others. Strict privacy mode is part of the exported settings, so it can arrive already on.
• To forbid any account across the fleet, the ExtensionSettings policy can block Hoome’s identity permission (blocked_permissions): signing in becomes impossible, everything else works.

What does not exist, and is better known before planning:

• No managed policy schema. Settings cannot be pushed from an admin console or by GPO. Importing the JSON file stays a manual step on each machine.
• No distribution outside the store: no self hosted package, no classic installer.
• No admin console, no inventory, no reporting, and none is planned in the near term.

If one of these limits blocks you, tell us. They reflect how young the product is, not a matter of principle.

The GDPR angle

Without an account, the publisher processes no personal data related to the use of the extension: no server contacted, no logs on our side, so on that scope no processor and no transfer outside the European Union. The optional Premium account is the exception: email address, name, Google identifier, signed in devices and subscription status, hosted at Netlify, the subscription itself being held by Paddle, merchant of record. A machine where Premium is not wanted can simply never sign in, turn on strict privacy mode, or receive the policy that blocks the identity permission. User data stays on the machine, under the browser’s control, and is erased from settings or by uninstalling.

Two points still deserve a line in your records if you keep them at machine level: icon requests expose the domain names of created shortcuts, along with the machine’s IP address, to Google and DuckDuckGo, like any image loaded from a third party site; and the weather widget, when enabled, sends the coordinates of the chosen city to Open-Meteo. These calls come from the browser, never from a Hoome server, and strict privacy mode removes them. The full detail is in the privacy policy, and the reasoning behind these choices is on our privacy first page.

Check it yourself

Real permissions are listed under chrome://extensions, Details, and in the manifest.json of the installed package. Traffic is verified in the Network panel of the developer tools on a reloaded new tab. Local data can be inspected in the Application panel, in the section dedicated to extension storage.

A question before you approve it

Write to contact@hoome.dev with your context: number of machines, internal constraints, points you need documented. A person will answer, not a form. If your review needs a document to file, we provide a detailed version of this page, matching the published release.