Before You Give: compatibility

Where the card can appear

The manifest declares these four HTTPS URL patterns. They identify URLs, not whether a page is a fundraiser or whether an organization is registered. Browser permissions and restricted-page rules still apply.

• https://www.gofundme.com/f/*
• https://gofundme.com/f/*
• https://www.justgiving.com/*
• https://www.every.org/*

Every path on the exact www.justgiving.com and www.every.org hosts matches, including information or account pages. Other subdomains and the bare JustGiving/Every.org hosts are outside this list. HTTP and lookalike domains are outside it too.

The matrix models Chromium’s path rules, including ordinary percent-encoding and its trailing /* shortcut: the GoFundMe /f prefix can match without a final slash. Queries are part of path matching; fragments are excluded. These modeled cases are not installed Firefox compatibility evidence. Navigation inside a page without a document reload has no reinjection guarantee.

The toolbar and your privacy

The popup offers ten checklist questions and an editable search. When active-tab access is available, it suggests the title. The card reads the title only after a lookup click. The search uses a browser-only URL fragment; external registries receive a name only when you choose their link.

Search input is limited to 120 characters. Failed tab opening leaves the text and a direct-link option. If the text changes while opening fails, submit the current text again. A failed hide preference leaves a visible notice and a Close control; it does not claim the preference was saved.

Permissions remain activeTab and storage. There is no background worker, analytics, donation handling or background page-text transmission. Read the privacy notice.

What has been checked

Automated checks execute the actual popup and card with synthetic DOM/API fixtures: 32 URL cases and 25 privacy/recovery groups. Independent ZIP/CRC checks, hostile-input refusal, source correspondence and reproducible builds cover all three packages. Checksums identify exact bytes; they do not establish an approved store listing.

Installed Chrome, Edge, Firefox, mobile, incognito and frame behavior, store approval and a comprehensive accessibility audit remain unverified. The actual Chrome HTML developer preview passed 320/390 layout, checklist keyboard controls, failed-navigation recovery and an explicit local fragment handoff. A synthetic host also exercised the card. These checks use ordinary HTML and a minimal fixture API, not an installed extension. The manifest declares Firefox desktop 140 and Android 142 minimums; those declarations are not device test results.

Matching references: Chrome documentation, Mozilla documentation and Chromium’s implementation. These were inspected October 27, 2026.

View the labeled developer preview.

Exact packages

Source SHA-256: 39c72ed30a3d39cb6613504e9d6217c289fb9170d6e25954ecee9c27a373e850. The source digest covers the ordered file paths, byte lengths and SHA-256 values in the release manifest. The manifest also contains package hashes, declared engines and empty store-listing records.

Developer installation instructions. Store submission and acceptance remain owner-controlled steps; no listing is claimed.