OrcamaticBrowser automation

ORCA / Privacy / Security

What “access to all websites” permission actually means

ORCA asks for a broad Chrome permission on every install. Here is exactly why it is needed, what it does and does not do, and how to check it yourself.

August 9, 2026

If you have looked at ORCA’s permissions before installing, you have probably seen this line: access to all websites. That is a reasonable thing to pause on, so here is exactly what it means and why it is there.

Why the permission exists

ORCA is built to work on whatever site you decide to automate: your inbox today, a CRM tomorrow, a client internal tool next week. Chrome extensions cannot ask for permission one website at a time and still work like that. The alternative would be re-approving or reinstalling the extension every time you pointed it at a new site. The broad host permission is what lets one install follow you anywhere you choose to use it.

That said, the permission being granted and ORCA actually doing something on a page are two different things. ORCA does not read, click, or fill anything on a page until you have shown it a task on that page. Visiting a site with ORCA installed is not the same as being automated by it.

Where your data goes

  • Saved workflows, click targets, and site profiles live in your browser’s own local storage. They are not uploaded to a server as part of normal use.
  • If a task uses the optional AI planner, only the page context that specific step needs is sent to the AI provider, and sensitive fields are masked before anything leaves your browser.
  • Simple, no-AI automations — a saved click sequence or a scheduled form fill — never touch the AI path, so nothing about that run leaves your machine.

What you can check yourself

You do not have to take our word for this. Chrome shows you exactly what a given extension can access on chrome://extensions. Click Details on ORCA and you will see the same permission list described here, with nothing hidden. You can revoke site access or remove the extension entirely at any time.

What it still will not do

ORCA reads and acts on what is actually on the page. It will not get you past a bank’s two-factor prompt, solve a CAPTCHA, or bypass a login wall. Those are designed to require a human, and they still will. If a workflow hits one of those, it stops and hands control back to you rather than guessing.

Permission is not activity. The broad host permission lets ORCA work on the sites you choose. The extension only acts after you tell it what to do on a page.

For a fuller explanation of local storage and optional cloud processing, read the Privacy & Sandboxing Policy.