Privacy & trust

Local-First Comment Export Without Sharing Login Cookies

How a current-page workflow can collect public feedback without turning browser credentials into a product input.

Published 2026-08-10 · 5 minute read

The browser session stays yours

FeedbackMosaic starts from the page the user has already opened. The extraction action is user initiated, and the extension reads only the page content needed for that task. It does not ask the user to paste a Cookie header, export a session, or hand over account credentials.

That boundary matters because a login session can expose far more than the public discussion being researched. A feedback tool should not make credential sharing the price of a convenient export.

What stays local by default

The working dataset is saved through the local Runner and can be downloaded again from local history.

  • comment and reply text;
  • displayed authors;
  • source URLs;
  • Excel, CSV, and JSON exports;
  • local task history.

Diagnostics are a separate decision

Anonymous technical diagnostics are off unless a public endpoint, a public privacy policy, and explicit user consent are all present. If enabled later, the allowlist covers task mechanics such as platform, version, result state, counts, and a controlled stop reason—not comment text, authors, full URLs, page titles, search terms, DOM, screenshots, or raw errors.

Turning diagnostics off must not disable extraction, local history, or file downloads.

The remaining platform boundary

Not collecting cookies does not bypass a platform restriction. Login walls, challenges, rate limits, or unavailable content can still stop a task. When that happens, preserving a partial result and explaining the stop is more trustworthy than claiming the page was fully collected.

Method note: page availability and platform structures can change. Test examples describe the recorded cases, not a universal collection guarantee.