Who can see my data?
Your project team can see your shared work, account name, presence, and chat. The backend processes that data and may keep logs. Your browser also stores settings, login state, and recovery copies.
Hide that I use CoBlocks only affects public usage badges. It does not make collaboration anonymous.
Why does the extension ask for access?
- Scratch access and cookies: connect the editor and identify the signed-in account.
- Storage: save preferences, login state, and recovery data.
- Clipboard: copy invites. Navigation access: handle project redirects.
- GitHub access: fetch release notes. Notification and custom-server access are optional.
More detail & reference
Browser permission reference
| Permission | Use in the extension |
|---|---|
| Storage | Saved preferences, authentication state, update state, and local recovery data. |
| Cookies | Identifying the Scratch account in the active browser profile and handling relevant auth state. |
| webNavigation | Handling navigation and project/account flows across Scratch pages. |
| clipboardWrite | Copying collaboration invite links. |
| alarms | Background scheduling used by the extension. |
| Scratch + API host access | Injecting editor/My Stuff/badge integrations and calling the CoBlocks service. |
| api.github.com host access | Fetching release notes for update announcements. |
| Optional Notifications | Browser chat alerts, requested when you enable the setting. |
| Optional custom HTTP(S) host access | Contacting the origin you explicitly configure as a custom server. |
What is stored where
Connections use the configured service. A custom-server operator is a separate party; make sure you trust them before sending projects or chat to that server.
- Browser profile: extension settings, account tokens, local project snapshots, and project-link recovery records.
- CoBlocks backend: verified account records, friends, collaboration membership, project snapshots/events, backpack scripts, and chat.
- Scratch: your Scratch account and saved Scratch project copies.
- Scratch Auth provider: the identity verification step used to establish your CoBlocks login.
Visibility and logs
This code does not provide end-to-end encryption for project chat or collaboration data. The server needs to process that data, logs chat, and can forward messages and filtered-content logs to an optional Discord webhook.
Hide that I use CoBlocks affects the public badge lookup. It does not hide activity from your project team or service operator. Browser-local recovery is not a cloud backup.