Last updated: 12 November 2026
This extension has no backend, account, analytics, or remote error-reporting service. It requests video pages and captions from YouTube to perform an export. Formatting preferences and a temporary print handoff stay in your browser’s extension storage. The extension does not upload transcripts to another service.
The extension processes three things, all of them locally, in your browser:
| Data | Why it is touched | Where it goes |
|---|---|---|
| The URL of the video you ask about | To identify which video’s transcript to fetch | Used to request that video’s page from YouTube. Never stored. |
| The URL of your active tab | To prefill the input box when you are already on a YouTube video | Read at the moment you open the popup, used to fill in the text field, and discarded when the popup closes. Never stored, never transmitted. |
| The transcript itself | It is the thing you asked for | Held in memory while the popup is open, and written to the PDF file you choose to save. Never transmitted. |
Two things, both in the browser’s extension storage, both local to your machine:
chrome.storage.local so
they survive closing the popup.chrome.storage.session so the printable page can read it. It
is deleted the moment that page renders, and session storage is cleared when
you close the browser regardless.Neither is synced. The extension does not use chrome.storage.sync, so nothing
is uploaded to a Google account.
The extension contacts exactly one host: youtube.com. It requests the video’s
watch page and, where YouTube allows it, the caption track. When YouTube blocks
the direct caption request, the extension instead opens the video in a browser
tab and reads the transcript panel YouTube itself renders.
Direct requests from the service worker use credentials: 'omit', so those
requests do not carry your YouTube cookies. The panel fallback opens or reuses
a normal YouTube tab. That tab follows the browser’s usual cookie and sign-in
behavior and can make YouTube’s own page requests. The extension reads the
rendered transcript and does not read cookies, tokens, or account credentials.
The extension has no telemetry endpoint, crash reporter, advertising integration, or custom update check. Chrome manages extension updates separately.
None. The extension has zero third-party dependencies and loads no remote code. Everything it runs is contained in the extension package.
Nothing is shared, because nothing is collected. No data is sold, and none is used for advertising, profiling, creditworthiness, or any purpose other than producing the transcript you asked for.
Your formatting preferences persist until you remove the extension, which deletes them. The temporary print handoff is deleted after rendering. If cleanup fails, the viewer reports it; closing the browser clears session storage. Apart from that handoff, the extension keeps the active transcript in popup memory until a refetch or closing the popup. Copied text follows your operating system clipboard retention, and downloaded files remain under your control.
PDFs you save are ordinary files on your computer. The extension has no access to them once they are written, and removing the extension does not affect them.
The extension requests five permissions, each tied to a specific feature:
tabs — read the active tab’s URL to prefill the input, and find a tab
already open on the video you requested.scripting — inject the transcript reader into a YouTube tab when the
direct caption download is blocked.storage — save your formatting preferences and hand the transcript to
the printable page.downloads — save the PDF.youtube.com and m.youtube.com — fetch video pages and
captions. No other site is accessible to the extension.If the extension’s data practices ever change, this policy will be updated and the change recorded in the repository’s commit history, which is public. The “Last updated” date above reflects the current version.
Questions about privacy, or anything else, can be raised at github.com/mithudso/youtube-transcript-to-pdf/issues.
For security issues specifically, please use private vulnerability reporting rather than a public issue.