TempoLife › Features › Browser extension › chrome

Chrome and Edge

Nothing is published in the Chrome Web Store. Here is what a Chromium build would look like, the permissions it would request, and a bookmarklet that works in Chrome and Edge today.

Not publishedBookmarklet: works todayChecked 2026-09-02

There is no TempoLife browser extension. It is not in the Chrome Web Store, not on addons.mozilla.org, and there is no unpacked build to sideload. Anything you find under that name is not ours. What is on this page is a description of what it would do, and a bookmarklet that does a useful slice of it today.

The bookmarklet in Chrome and Edge

Press Ctrl+Shift+B (Cmd+Shift+B on a Mac) to show the bookmarks bar, then drag the button below onto it. Select a food name on any page and click your new bookmark.

TempoLife food lookup

Drag that button to your bookmarks bar. Do not click it here. This page sends a strict Content-Security-Policy that forbids inline script, so a click on this site is blocked by design — which is also a small demonstration that the page is not running it for you. Once the link lives in your bookmarks bar it runs against whatever page you are on instead.

What it does, in order

1. Reads the text you have selected on the current page. Nothing else on the page is read.
2. If you selected nothing, it asks you what to look up, pre-filled with an example.
3. Collapses whitespace, trims, and cuts anything over 160 characters — the limit /api/answer enforces, so a long selection returns an answer instead of an error.
4. Opens https://tempolife.app/api/answer?q=… in a new tab with noopener, so the new tab cannot reach back into the page you came from.

The source, in full

Read it before you install it. That is the point of a bookmarklet: it is small enough that you can.

javascript:(function () {
  var q = '';
  try {
    q = String(window.getSelection ? window.getSelection() : '');
  } catch (e) {
    q = '';
  }
  q = q.replace(/\s+/g, ' ').trim();
  if (!q) {
    q = String(window.prompt('Ask TempoLife about a food', 'calories in banana') || '');
    q = q.replace(/\s+/g, ' ').trim();
  }
  if (!q) { return; }
  if (q.length > 160) { q = q.slice(0, 160); }
  window.open('https://tempolife.app/api/answer?q=' + encodeURIComponent(q), '_blank', 'noopener');
})();

There is no fetch, no XMLHttpRequest, no injected <script>, no cookie access, no localStorage, and no code loaded from anywhere. It reads a selection and opens a URL. The minified form in the link above is this and nothing more, percent-encoded so no quote or angle bracket ends up in an HTML attribute.

What it sends, and where

The text you selected is sent to tempolife.app in the URL of the new tab, because that is how a query parameter works. Select a food name, not a private sentence. The endpoint logs are ordinary web-server logs; nothing is attached to an account, because the bookmarklet sends no cookie and needs no sign-in.

Where it will not work

Sites with a strict Content-Security-Policy of their own can block bookmarklets — behaviour varies by browser and has changed more than once. Browser-internal pages such as chrome:// or about: never run one. And on mobile, bookmarks bars mostly do not exist; use the form below instead. When a bookmarklet fails it usually fails silently, so if nothing happens, that is why.

Chromium browsers will not run a bookmarklet on chrome://, edge:// or the Web Store itself, and Chrome strips a leading javascript: from text you paste into the address bar — which is a sensible anti-scam measure and the reason this is a drag rather than a copy.

The same thing without a bookmark

No JavaScript, no extension, no account. It returns raw JSON because it is an API endpoint rather than a page — which is exactly what makes it useful from a script of your own. The developer portal documents the response shape and the 60-per-hour rate limit.

What a Chromium build would be

Manifest V3, which is now the only option: a service worker instead of a background page, no remotely hosted code, and declarative rules where the old API let an extension inspect traffic freely. For a nutrition overlay those constraints cost almost nothing — it needs to read one page when asked and draw a panel — and they are the reason a well-behaved extension in this category can now be reviewed meaningfully.

The build would be one codebase for Chrome, Edge, Brave, Opera and Vivaldi, since all of them consume Chrome Web Store packages. Edge additionally has its own add-ons store, which would mean a second listing of the same package rather than a second build.

Permissions it would ask for, and why each one

A recipe overlay needs less access than people assume, and the difference between a well-scoped extension and a badly scoped one is visible in the install prompt. This is the manifest it would ship with.

What it would deliberately not ask for

• <all_urls> at install time — the permission that makes an extension able to read every page you ever open. Per-site consent is slower to use and much easier to trust.
• tabs — the full URL and title of every open tab, which is a browsing history feed.
• cookies, webRequest, history, bookmarks, downloads, identity — none of them are needed to put nutrition on a recipe.
• Remote code. The whole point of a review process is defeated by an extension that fetches its logic after installation, and both stores now forbid it.

If a nutrition extension you are considering asks for access to all sites at install time and does not explain why, that is worth a moment's thought regardless of whose it is.

What the store review would cover

Worth knowing what "reviewed" means, because it is often over-read. Chrome Web Store review checks that the requested permissions are justified by the described functionality, that no remote code is executed, that the privacy disclosures match observable behaviour, and that the listing is not deceptive. It is a meaningful bar and it is not a security audit. An extension can pass review and still be sold to someone else next year, which is the failure mode that has actually harmed people. Judge an extension on the permissions it holds, not the badge on its listing.

Two things to check on any nutrition extension before you install it: whether it requests access to all sites at install time, and whether its privacy disclosure claims no data collection while its listing includes an analytics SDK. Both are visible before you click Add.

Frequently asked questions

Source: TempoLife /api/answer endpoint — live, documented in the developer portal · checked 2026-09-02

Other pages

Extension overview · The API it would use · Embeddable widgets