What the Add to CRM Extension Can and Cannot See

Short answer: Add to CRM asks Chrome for five permissions and for access to all websites. It uses them to open a side panel, show buttons in Gmail, Outlook and Google, and fill in your text snippets. Your CRM keys stay on our servers, encrypted, and the extension sends its data requests only to Add to CRM.

This page covers every permission in the Add to CRM manifest (the file that tells Chrome what an extension may do), as it stands in October 2026.

The permissions, one by one

The manifest asks for five permissions and one host permission. It declares no optional permissions.

What it does on the pages you visit

Here is what its scripts do on each kind of site.

• Gmail and Outlook on the web. It reads the names and email addresses on the email you have open, asks our servers whether each person is in your CRM, and shows the answer on a button. If you use Sync Thread, it reads that thread and sends it to our servers to log in your CRM. If your CRM has a BCC address and you turn on auto-add, it adds that address to the BCC line of emails you write.
• Google Search and Maps, on 14 Google country sites. It adds a button beside a business's website link. Nothing is sent until you click it.
• Company websites, off unless you switch them on. The button is decided inside your browser, and nothing is sent to us until you click it or open the panel there.
• addtocrm.com. A small script lets our website see that the extension is installed.
• Other web pages. The snippet listener reads the few characters before your cursor to spot your snippet shortcut (// unless you changed it).

Everything the extension draws inside a page sits in a closed shadow root, apart from the page's own code.

What is stored where

In your browser, in the extension's storage: your settings, your snippets, and recent results (the people and companies you looked up, and whether they are in your CRM). Results are capped at 150 person lookups and 30 entries for most other requests. Your account details are fetched fresh and not saved to disk. Your CRM keys are not kept here. Older versions kept an encrypted copy, which current versions move to our servers and then delete.

On our servers: your account and your CRM connection. CRM API keys and sign-in tokens are encrypted with AES-256-GCM, and deleted when you disconnect your CRM or delete your account. Lookup results are cached for up to 30 days, and operation logs are kept for up to 12 months. To find someone's details, our servers send identifiers, such as an email address or a name and company, to our data providers. If your plan lets you browse your CRM records, we keep an index of them, without copying phone numbers. We never sell personal data.

In your CRM: the people and companies you add or update, with the fields you mapped, and updates from features you choose to use, such as conversation sync or job change alerts on people you watch. The extension never connects to your CRM itself. Our servers do.

What the extension never does

• Its data requests go only to Add to CRM. Every data request goes to api.addtocrm.com, and its security policy allows connections only to addtocrm.com and api.addtocrm.com. The one exception is pictures: when the panel shows a person's photo or a company logo, your browser loads that image from its own address, as it does for any image on a web page.
• The snippet listener never sends what you type. Snippets fill in from what the extension already holds, with no network request.
• It never runs code from other sites. Its security policy allows only the scripts packaged with it.
• It never shares its own files with web pages. It declares no web-accessible resources.
• It never asks for more than the list above. It has no optional permissions, and it does not request Chrome's history, bookmarks, cookies, downloads or webRequest permissions.

Questions people ask before installing

Why does Chrome say Add to CRM can "read and change all your data on all websites"?

That is Chrome's wording for the <all_urls> host permission. Add to CRM uses it for snippets on any site, the optional company website button, and reaching its own server with your session.

Can the extension see my browsing history?

The tabs permission lets it see the address and title of your open tabs, so it knows what to show on the tab you are on. It does not request Chrome's separate history permission.

Does Add to CRM read what I type?

The snippet listener reads the few characters before your cursor, to spot your snippet shortcut. It does not send what you type to us or to anyone else.

Does the extension store my CRM API key?

No. Your CRM API keys and sign-in tokens are stored on our servers, encrypted with AES-256-GCM. The extension signs in to Add to CRM with a session cookie.

Who does the extension send data to?

Only Add to CRM, at api.addtocrm.com. Our servers then contact our data providers and your CRM for you. Photos and logos shown in the panel load from the image's own address.

Can I turn the extension off on some sites?

Yes. Under Settings in your Add to CRM dashboard, you can switch its buttons on or off for Gmail, Outlook, and Google Search and Maps, among others. Company websites stay off unless you switch them on. Switching a site off removes what the extension added there.

Try it on your own CRM

If that fits what you are comfortable with, watch it work on your own inbox and CRM. Start your 7-day trial. The trial needs a card, but you are not charged until it ends, and we email you the day before. For more detail, see our security page and privacy policy.