Hoome for IT teams

The short version

• What it is: a Chrome extension (Manifest V3) that replaces the new tab page with a page of shortcuts, folders, instant search and optional widgets.
• Permissions: storage, unlimitedStorage, search, system.cpu and system.memory, plus access to two icon services. Bookmark access is optional and only requested when a user starts an import, like access to the most visited sites, only requested when the user clicks “Also suggest your most visited sites”. Signing in to a Premium account, optional too, is only requested when the user clicks “Sign in with Google”.
• Network: two icon services receive the domain name of your shortcuts. The weather and tides widgets, off by default, call Open-Meteo. Nothing else leaves the machine, apart from browser sync if a user turns it on, and the copy of their desks that the Premium account sync keeps on hoome.dev.
• Vendor side: no account is needed, and without one the extension never contacts the publisher. The optional account only serves the Premium subscription, and keeps the copy of their desks that the account sync entrusts to it. Sync, off by default, goes through the user’s browser account, never through the publisher. No telemetry, no advertising.
• Full cut off: a strict privacy mode stops every network request the extension makes, icons included.

The permissions, in plain words

Permission	What it allows
storage	Save shortcuts, folders, settings, notes and tasks in the local storage area Chrome reserves for the extension, and in synced storage if the user turns sync on.
unlimitedStorage	Go beyond the default quota of that area: cached icons, an imported wallpaper and local backups can reach it.
search	Hand a search typed in the bar to the browser, which runs it with the search engine chosen in its own settings. Hoome neither picks nor changes the engine.
system.cpu and system.memory	Show processor and memory load in the Premium CPU and Memory widgets, once a second while one is displayed. Nothing is stored or sent.
bookmarks, optional	Read the bookmark tree once, to build the folders the user ticked. Not present at install time, requested on the import click, revocable from chrome://extensions. Bookmarks are never modified and never transmitted.
topSites, optional	Read, on the machine, the list of most visited sites, to suggest them in the “New shortcut” window. Not present at install time, requested on the “Also suggest your most visited sites” click, revocable from chrome://extensions. The list is neither stored nor transmitted, and no icon is requested for those sites before they are added. Not in the Firefox package.
identity, optional	Open Google’s sign in window when the user clicks “Sign in with Google”, for the Premium account. Absent at install, no Chrome warning, removable from chrome://extensions.
notifications and alarms, optional	Announce the end of a timer session, even with the tab closed. Requested the first time a user starts a timer, removable from chrome://extensions.
New tab page override	Show the extension page when a tab opens. That is the whole point of Hoome.
Access to gstatic.com and icons.duckduckgo.com	Download a site icon from Google’s icon service, or from DuckDuckGo when Google returns nothing usable.

Nothing else is declared: no tabs, no history, no cookies, no webRequest, and no content script injected into the pages your staff visit. The content security policy limits execution to the code shipped in the package, so no script, font or stylesheet is fetched from the internet.

The externally_connectable key lets only https://hoome.dev pages send a message to the extension, to hand over a one time sign in ticket between the site and the extension. It triggers no warning and grants no access to the pages visited.

One point worth explaining internally: at install time, Chrome summarises the two host permissions with its generic wording, “Read and change your data on gstatic.com and icons.duckduckgo.com”. That is the standard label for any host permission. In practice, the extension only downloads images there.

The three quick access buttons

Buttons for history, downloads and bookmarks ask Chrome to open its own internal page in the current tab. That navigation does not require the tabs permission, which is what grants access to tab contents: the extension displays the browser page, it reads nothing from it. The buttons can be hidden in settings.

What leaves the machine, and where it goes

This is the complete list of addresses the extension can call on its own.

Address	When	What is sent
Google icon service (t3.gstatic.com)	When a shortcut is added, and the first time a shortcut without an icon is shown. After a failure, one retry per week at most. Never when the icon is cached, or when initials or a custom image were chosen.	The site host name, for example hmrc.gov.uk. Not the path, not the page title.
icons.duckduckgo.com	Same conditions, only if Google returned nothing usable.	The site host name.
geocoding-api.open-meteo.com	Weather widget enabled, while the user types a city name in settings.	The typed text and the interface language.
api.open-meteo.com	Weather widget enabled and a city selected: on page load if the forecast is older than thirty minutes, or on manual refresh.	The coordinates of the chosen city and the forecast fields requested.
marine-api.open-meteo.com	Tides widget enabled and a place selected: on page load if the water levels are older than three hours, or on manual refresh.	The coordinates of the chosen place and the field requested, the water level.
hoome.dev	Only if the user signs in to the optional Premium account: at sign in, when opening the Account section of the settings, when clicking “Open my account”, and, once signed in, when a tab opens (at most once a minute) and after each change, to read and deposit the copy of the desks. Never in strict privacy mode.	The account session token, and at sign in the code returned by Google. Shortcuts, folders and notes in one case only: a signed-in Premium subscriber who has not turned sync off deposits a copy of their desks under their account, without any image or the device’s position.

Four details that matter during a review:

• Icons are converted to small images, stored locally, and never requested again.
• No user, install or machine identifier is attached to these requests. They carry the browser’s usual headers, like any image.
• Widgets are off by default, so a fresh install only ever contacts the two icon services.
• The search bar hands the query to the search engine chosen in the browser when the user presses Enter, exactly like typing in the address bar, with no suggestion requests while typing. Geolocation is only asked for on an explicit click in the weather settings, through Chrome’s own permission prompt.

Cutting the network entirely

For a machine where nothing may leave, not even a domain name, settings offer a strict privacy mode under Data. Once enabled, the extension issues no network request at all: site icons are replaced by coloured initials, the weather widget becomes unavailable and its switch is greyed out. Signing in to the account becomes impossible, and an extension already signed in no longer contacts hoome.dev.

Icons already cached stay visible, since they are local, and a button clears them after confirmation. The mode survives an import, a backup restore or a reset to default shortcuts, so none of those actions can quietly start requests again. Everything local keeps working: backups, export, import, bookmark import.

Where the data lives

Everything is written to the local storage area Chrome reserves for each extension, on the machine. Synced storage is only used if the user turns sync on: the data then travels through the user’s own Google account, never through our servers, and strict privacy mode turns it off. Nothing is sent to a server of ours, apart from the Premium account session for users who sign in, and the copy of their desks that the Premium account sync deposits there.

That area holds shortcuts and folders, settings, notes and tasks, an open counter per shortcut used to rank search results, a copy of the previous state written before each save, the last three backups, an imported wallpaper and the latest weather forecast when the widget is on. For users signed in to the account, the session is added, stored apart: never exported, never backed up.

On uninstall, Chrome wipes that storage entirely, backups and icon cache included. Nothing survives anywhere else, except, for users with an account, that account and the copy of the desks that sync keeps there: both are deleted together from the account page, on hoome.dev. Without uninstalling, a settings command empties shortcuts and folders after taking a restorable backup.

To carry a setup over, the JSON export produces a file downloaded to the machine: shortcuts, folders, notes, tasks, settings, and optionally icons and wallpaper. It is sent nowhere, and imports onto another machine, which is the recommended path before a hardware refresh.

Rolling it out to a fleet

What works today:

• The extension is published on the Chrome Web Store, so it deploys through the usual Chrome policies, force install or allow list, using the item ID we provide on request.
• The package loads no remote code. The version your team reviewed is the one that runs, until the next store update.
• To standardise machines, configure a reference workstation, export the JSON file and import it on the others. Strict privacy mode is part of the exported settings, so it can arrive already on.
• To forbid any account across the fleet, the ExtensionSettings policy can block Hoome’s identity permission (blocked_permissions): signing in becomes impossible, everything else works.

What does not exist, and is better known before planning:

• No managed policy schema. Settings cannot be pushed from an admin console or by GPO. Importing the JSON file stays a manual step on each machine.
• No distribution outside the store: no self hosted package, no classic installer.
• No admin console, no inventory, no reporting, and none is planned in the near term.

If one of these limits blocks you, tell us. They reflect how young the product is, not a matter of principle.

The GDPR angle

Without an account, the publisher processes no personal data related to the use of the extension: no server contacted, no logs on our side, so on that scope no processor and no transfer outside the European Union. The optional Premium account is the exception: email address, name, Google identifier, signed in devices, subscription status and, with the Premium sync, a copy of their desks, hosted at Netlify, the subscription itself being held by Paddle, merchant of record. A machine where Premium is not wanted can simply never sign in, turn on strict privacy mode, or receive the policy that blocks the identity permission. User data stays on the machine, under the browser’s control, and is erased from settings or by uninstalling; the copy sent to the cloud is erased by deleting the account.

Two points still deserve a line in your records if you keep them at machine level: icon requests expose the domain names of created shortcuts, along with the machine’s IP address, to Google and DuckDuckGo, like any image loaded from a third party site; and the weather and tides widgets, when enabled, send the coordinates of the chosen place to Open-Meteo. These calls come from the browser, never from a Hoome server, and strict privacy mode removes them. The full detail is in the privacy policy, and the reasoning behind these choices is on our privacy first page.

Check it yourself

Real permissions are listed under chrome://extensions, Details, and in the manifest.json of the installed package. Traffic is verified in the Network panel of the developer tools on a reloaded new tab. Local data can be inspected in the Application panel, in the section dedicated to extension storage.

A question before you approve it

Write to contact@hoome.dev with your context: number of machines, internal constraints, points you need documented. A person will answer, not a form. If your review needs a document to file, we provide a detailed version of this page, matching the published release.