We’re upgrading our email infrastructure — for immediate response, email andrewjgaber@gmail.com meanwhile.
Skip to main content
Part of Digital Empire
Chrome extension · v1.0.2

Install the PixelProof Chrome extension in under 60 seconds.

One-click storefront + admin tracking checks on every Shopify page you open. Works today, before Chrome finishes reviewing our public listing — real signed .zip, real load-unpacked flow, no fake "coming soon" badge.

Download PixelProof v1.0.2 (.zip)

Chrome Web Store listing is under review. Founding customers can install today via the 5-step Developer Mode walkthrough below — this is the same signed build we submitted for review, SHA-256 1dd600ea11fd…

What the extension does once installed

The extension has two jobs, and it does both automatically on every Shopify tab you open — no button clicks required after install.

  1. Passive badge counter. On any *.myshopify.com or admin.shopify.com tab, a lightweight MutationObserver counts pixel-family loader scripts (Meta's connect.facebook.net, Google's googletagmanager.com, TikTok's analytics.tiktok.com, Klaviyo, Snap, Pinterest) as they load. The extension icon shows a red badge with the count. Zero admin login, zero data leaves your browser.
  2. User-initiated deep scan. Click the toolbar icon → "Run pixel audit on this store". The content script builds a full DOM snapshot, hands it to the extension's background service worker, which runs the same signed rules engine the web scanner uses (fetched from /api/meta-monitor/rules.json, 1-hour cache, ECDSA-verified) and returns findings straight into the popup with paste-ready fix snippets.
  3. 6-hour background storefront check. For any store you add on the extension's Options page, the background worker fetches your public storefront HTML every 6 hours (Chrome alarms API — same mechanism that survives service-worker suspension) and pushes results to your PixelProof account so weekly email alerts fire on state changes. Admin-side scans are user-initiated only, never passive — PPA compliance.

Load unpacked — 5-step walkthrough

Chrome's Developer Mode is the officially documented mechanism for loading local or unlisted extensions. It's what every extension developer uses to test their own work, and what Google recommends for pre-review installs (Chrome for Developers: "Load an unpacked extension" developer.chrome.com/docs/extensions/get-started/tutorial/hello-world).

  1. 1. Download and unzip. Click pixelproof-v1.0.2.zip above. macOS unzips on double-click; Windows: right-click → "Extract All". You'll end up with a pixelproof-v1.0.2/ folder containing manifest.json, background/, content/, popup/, options/, and icons/. If you're security-conscious, open manifest.json in any text editor and confirm the host_permissions list matches what you see below (only Shopify domains and our API base URL).
  2. 2. Open the Chrome extensions page. Paste chrome://extensions into your Chrome address bar and hit Enter. Alternatively: three-dot menu → Extensions → Manage Extensions. Also works in Chromium-based browsers (Brave, Edge, Arc, Opera) — same URL.
  3. 3. Turn on Developer Mode. Toggle the "Developer mode" switch in the top-right corner of chrome://extensions. A new row of buttons appears: "Load unpacked", "Pack extension", "Update".
  4. 4. Load unpacked. Click "Load unpacked" and select the pixelproof-v1.0.2/ folder you unzipped in step 1. Chrome loads the extension immediately. You'll see the PixelProof card appear in the extensions list with a red icon and version 1.0.2. Chrome may show a "Loaded from local file" badge — that's expected for any unpacked extension and disappears the moment we swap this over to the CWS listing.
  5. 5. Pin the icon (optional but recommended). Click the puzzle-piece icon in Chrome's toolbar, find PixelProof, click the pin. Now the icon lives next to your address bar with a live badge showing pixel loader count on every Shopify tab. Open any *.myshopify.com URL and the badge starts counting within a second of the page loading.

Total time: about 45 seconds if you already have Chrome open. Under 2 minutes if this is the first time you've used Developer Mode.

FAQ — safety, permissions, uninstalling

Is loading an unlisted extension safe?

Loading a local unpacked extension in Chrome is exactly as safe as the extension itself — the load mechanism doesn't change what the extension can do; it just changes where Chrome got it from. The extension's permissions are declared in manifest.json, which you can (and should) read before installing any extension, whether it comes from the Chrome Web Store or from us directly. PixelProof is fully open source in our GitHub repo (chrome-extensions/pixelproof/ subdirectory) — the same source that built the .zip you download here is the same source we submitted for CWS review.

What permissions does the extension request, and why?

Exactly four Chrome API permissions, no more:

  • storage — save your list of monitored stores + last scan result locally in chrome.storage.local. Never syncs to Google.
  • activeTab — read the currently open Shopify tab's DOMonly when you click the extension icon. This is the least-privilege Chrome permission for tab access; it does not grant background access to any tab.
  • scripting — inject the content script into the tab when you run a deep scan (already scoped to *.myshopify.com and admin.shopify.com in the manifest).
  • alarms — schedule the 6-hour background storefront check. Required because MV3 service workers can't rely on setTimeout/setInterval surviving suspension; Chrome's alarms API is the officially documented replacement.

Plus three host permissions, matching the content-script injection list exactly (never broader): *://*.myshopify.com/*, *://admin.shopify.com/*, and https://digital-empire-app.vercel.app/* (the extension's API base — used for fetching the signed rules feed and uploading scan results).

Does it inject scripts on non-Shopify sites?

No. The content_scripts block in manifest.json is explicitly scoped to *://*.myshopify.com/* and *://admin.shopify.com/*. If you open Google, Amazon, or any non-Shopify site, the content script is not loaded, the badge does not increment, and no data leaves your browser for that tab. This is enforced by Chrome itself, not by the extension code.

Where does the data go?

User-initiated deep scans send a DOM snapshot (script src attributes + inline script text, truncated to 4KB per script) to digital-empire-app.vercel.app/api/pixelproof/extension/scan-write using your logged-in account token. Background 6-hour storefront checks send the same structured payload. Nothing else is uploaded — no cookies, no localStorage, no page screenshots, no personally identifiable information. Full data-flow diagram in our Privacy Policy.

How do I uninstall?

Same as any Chrome extension: chrome://extensions → find the PixelProof card → click "Remove". Chrome asks to confirm, and every trace of the extension (including chrome.storage.local data) is deleted immediately. Uninstalling here does not cancel your PixelProof subscription; use the account page for that (or email hello@citationsafe.com).

What happens when the Chrome Web Store listing goes live?

We'll email every founding customer a one-click migration link that installs the signed CWS build over the top of the unlisted install. Chrome recognizes it as an update (same extension ID isn't possible across CWS vs. unpacked — Chrome assigns a fresh ID to the CWS install — so it's technically a fresh install with your Options-page store list preserved via export/import from chrome.storage.local). The unlisted .zip on this page will continue to work for as long as any customer wants to keep running it — we don't deprecate or force-migrate.

Does this work in Brave, Edge, Arc, Opera?

Yes — every Chromium-based browser accepts the same MV3 manifest and load-unpacked flow. Safari and Firefox are on our roadmap (Firefox's WebExtensions API overlaps ~95% with Chrome's, so the port is small; Safari requires an Xcode wrapper which is a bigger lift) but not shipping today.

What you'll see once it's installed

These are the same frames from our product demo, captured from a live PixelProof scan of a real Shopify storefront. Every finding shown is a real severity-tagged issue our rules engine surfaced on a public store — not staged.

PixelProof scan result frame 1: severity-tagged tracking findings on a real Shopify storefront.
PixelProof scan result frame 2: severity-tagged tracking findings on a real Shopify storefront.
PixelProof scan result frame 3: severity-tagged tracking findings on a real Shopify storefront.
PixelProof scan result frame 4: severity-tagged tracking findings on a real Shopify storefront.

Prefer to see it in motion? The full product demo video is on the main landing page (8-second live scan, 7+ findings surfaced).

After you install

  1. Open any Shopify store tab. The badge starts counting within a second. If you don't see the badge, right-click the toolbar icon → Options → add your store domain, then refresh the tab.
  2. Click the icon and run a deep scan. First scan takes about 4 seconds. Findings appear in the popup with paste-ready fix snippets for anything broken.
  3. Sign in with your PixelProof account (via the Options page) so scan results push into your account history and email alerts fire on state changes. Don't have an account yet? Grab a plan— the extension works standalone but the alerting layer needs an account.

Hitting an issue? Email hello@citationsafe.com with the extension version + a screenshot of chrome://extensions → PixelProof → "Errors" button and we'll turn it around fast.