GoFully — Full Page Screenshot Chrome Extension
GoFully
Security & Privacy

Nothing you capture ever leaves your device

GoFully runs entirely inside your browser. Capture, text extraction, and editing all happen on-device — there's no server in the loop, no account to create, and nothing sent anywhere without your permission.

On-Device by Design

Every step of the workflow runs locally

CAPTURE

The page is captured and stitched together directly in your browser tab. No screenshot ever crosses the network.

EXTRACT

A local WebAssembly model reads text off the image on your CPU. Nothing is uploaded for recognition.

STORE

Results stay in local browser storage until you export or discard them, and clear automatically when you close the tab.

Permissions

Every permission has a job, and only that job

Chrome requires extensions to declare access up front. Here's exactly what GoFully asks for and why.

activeTab

Lets GoFully read the current tab only when you click capture — never in the background, never on tabs you haven't opened it on.

tabs

Coordinates a capture against the specific tab you started it on, and reads that tab's title/URL for export metadata.

scripting

Injects the page-measurement, sticky-header, and lazy-load helper scripts needed to stitch a full-page capture — only on the tab you're capturing.

offscreen

Runs canvas stitching and the local WebAssembly OCR engine in a background document — still entirely on your machine.

downloads

Needed so a PNG, JPG, WebP, or PDF export can save straight to your downloads folder when you choose to save one.

storage

Keeps your editor preferences, capture history, and in-progress result on your machine only — never synced to a server.

host_permissions (all sites)

Full-page and scrolling-area capture need to run on whatever site you're actively viewing when you invoke them — this is user-initiated per page, never a background scan.

Technical safeguards

For the technically curious — specific defenses in how GoFully is built, not just what it promises.

Sender-verified tab targeting. Capture-critical messages resolve the target tab from the browser's own message sender, not from a value a page could hand the extension — a compromised content script can't redirect a capture to another tab.
Strict image-source validation. Anything loaded into the editor canvas must be a data:image/ URI — no remote or script-scheme sources are ever accepted.
Locked-down content security policy. script-src 'self' on every extension page — no remotely hosted or inline script can execute.
Manifest V3 native. Built on a non-persistent service worker from day one — not a Manifest V2 extension retrofitted to pass review.

What GoFully doesn't do

No cloud uploads of captures, ever
No account or sign-in required
No analytics or usage tracking
No ads or third-party trackers

Found a security vulnerability?

Report it directly to our maintainers. See the support page for other contact channels.

rahamanmuzeeb1108@gmail.com