Browser extension
Disclosed
It marks the affiliate links on the page you are reading with a small dot beside them, and tells you which network and which merchant. That is all it does.
It makes no network request. Not “by default”.
The manifest declares no permissions and no host permissions, so the browser will not let this
extension reach the network at all. That is not a policy we are asking you to take on trust; it
is a fact about what the browser permits, and you can read it in the shipped
manifest.json in about ten seconds.
What it never sends
- Never a URL you visited, to us or to anyone.
- Never the page’s content, title, text, or the links on it.
- Never an identifier. There is no account, no email, no user id, no install id, no device id and no cookie.
- Never analytics, telemetry, error reporting or usage counts.
- Never a request to a merchant, an affiliate network, or a redirector. It does not follow, prefetch, resolve or fire an outbound link.
Nothing is written to localStorage, chrome.storage, IndexedDB or a
cookie. It keeps no record of anything you looked at, including in memory after the tab closes.
What it never does to the page
It never touches a link. It does not strip, replace, inject, rewrite, redirect or fire an affiliate link — not as a feature, not as an option, not behind a flag. It inserts a dot beside a link, in the link’s parent, after it.
Extensions that overwrite a creator’s affiliate tag with their own take a commission somebody else earned. That practice is one of the things this project exists to document, and an extension that did it while claiming to expose it would have nothing left to say.
How to check every claim above
The source is MIT licensed and the claims are greppable in the built output.
git clone https://github.com/nchzingo/disclosed-extension
pnpm install
pnpm --filter @disclosed/core build
pnpm --filter @disclosed/extension build
cat packages/extension/.output/chrome-mv3/manifest.json # no permissions block
pnpm --filter @disclosed/extension verify-built # drives the shipped bytes
verify-built loads the shipped content script into a page containing real
affiliate link shapes, lets it run, and reports: every anchor byte-identical before and after,
markers actually inserted so the check is not vacuous, and fetch,
XMLHttpRequest, sendBeacon and the message channel to the background
worker all called zero times.
The source, MIT licensed — printed rather than linked, for the same reason the crawler page prints its own URL: this page loads nothing from anywhere and makes that trivial to check.
https://github.com/nchzingo/disclosed-extensionAn unauditable privacy claim is worth nothing, which is the entire reason the source is public.
Limits, stated here rather than found later
- No commission rate is shown anywhere in the extension. A rate has to be displayed with the page it was read from and the date it was read; a popup showing a bare percentage would be a rate without provenance.
- A cloaked link the extension cannot resolve stays unmarked. It is shown as cloaked with an unknown destination, never as paying nothing.
- The scan stops at 2,000 anchors per page and says so when it does.
- A site with no marked links is a site where no affiliate link was detected, not a site that earns nothing. Display advertising, placement paid outside an affiliate network, subscriptions and licensing are all outside what this sees.
Support and contact
bot@disclosed.info — questions, bug reports and corrections.