Last updated: October 15, 2026
The canonical Lesuto Technologies privacy policy is at www.lesuto.com/legal/privacy. This page is the Chrome Web Store permission disclosure for the Lesuto Chameleon Toolkit only. It does not replace the platform privacy policy.
Lesuto Chameleon Toolkit is a Chrome extension published by Lesuto Technologies, Inc. It is a developer tool for merchants, suppliers, and developers building on the Lesuto Chameleon e-commerce platform. The extension can block analytics and tracking requests during development sessions so that developer activity does not pollute production metrics, and provides a one-click visual editor (the “Studio”) for the Chameleon SDK. The tracking / ad shield is off by default. The user must turn the master switch on in the popup for blocking or cosmetic hiding to take effect.
The Lesuto Chameleon Toolkit does not collect, transmit, or store personal information about you for the publisher's purposes.
The extension specifically:
The single exception — covered in detail in “Authentication Information” below — is the user's existing Lesuto admin session token, which the extension reads from the same browser tab the user is already signed in to and which is only ever sent back to the same admin API the user is already authenticated with.
To enable the Studio companion feature, the extension reads two values from
localStorage on admin.lesuto.com when the user has that
site open in another tab:
vendure-auth-token — the user's existing admin session token.vendure-selected-channel-token — the user's currently active channel.
These values are stored locally in chrome.storage.local under the key
lesutoAuth. They are used to:
https://api.lesuto.com/api/v3/admin/graphql), which proxies to the
same admin backend the user signed into.sdkPreview tokens for previewing draft Studio
configs through the same gateway.postMessage.
The auth token is never sent to any server other than Lesuto's
first-party API gateway (api.lesuto.com), which proxies to the admin
backend the token came from (admin.lesuto.com). It is
never sent to a publisher analytics endpoint, third-party service,
or anywhere outside the user's own tenant. Closing the admin tab does not clear the
extension session. To disconnect the extension, use Sign out in the popup (this does
not log you out of admin) or sign out of admin while an admin tab is open. Sessions
older than 30 days are discarded.
The extension uses chrome.storage.local to persist state on the local
device. None of this data leaves the browser except as described above for the auth
token.
| Storage key | Purpose | Sent externally? |
|---|---|---|
shieldState.enabled |
Whether the tracking shield is on or off | No — local only |
shieldState.categories |
Per-category blocking toggles | No — local only |
shieldState.blockCounts |
Per-category counters for the popup display | No — local only |
studioUiLanguage |
Selected Toolkit and Studio interface language so both surfaces stay synchronized | No — local only |
lesutoAuth |
User's own admin session token, mirrored from admin.lesuto.com localStorage. Kept after the admin tab closes until Sign out, admin logout, 401/403 on Open Studio, or 30-day max age. | Only to api.lesuto.com (the first-party gateway proxying to the admin backend the token came from) |
lesutoCompanionPrefs |
Last selected channel token and store/deployment ID for the popup pickers | No — local only |
draft_{channelToken}_{host}_{siteId} |
Pending Studio editor configurations the user has not yet published. The trailing site segment scopes drafts per-deployment so a single channel with multiple stores never overwrites a sibling store’s pending changes. | Only to admin.lesuto.com when the user clicks “Publish” |
liveBundleUpdate |
Opt-in flag and version metadata after the user confirms the SDK update disclosure. The downloaded SDK and Studio files are stored in IndexedDB on this device so Open Studio can use them. Clearing the flag (Use packed version) deletes that cache and returns to the files packed in this listing. | No. The download itself is a GET of first-party Toolkit files from cdn.lesuto.com/chrome-toolkit/vendor/ after the user confirms the disclosure. |
| Permission | Why It's Needed |
|---|---|
declarativeNetRequest |
Block analytics, ad network, and pixel requests at the browser level before they are sent. Uses Chrome's built-in rule engine — the extension never sees request bodies or response content. |
declarativeNetRequestFeedback |
Count how many network-level requests were blocked, displayed in the popup. Available only in unpacked/dev mode; production block counts come from the content-script intercepts. |
storage |
Save user preferences, block counters, the auth token described above, and
studio drafts in chrome.storage.local. |
activeTab |
When the user clicks “Open Studio,” grants temporary access to the active tab so the extension can inject the Studio script. Granted only on user interaction with the popup. |
scripting |
Used in three user-driven flows: (1) inject the Studio script on
“Open Studio,” (2) bridge studio saves to an open admin tab via
chrome.scripting.executeScript, and (3) when the shield is on and
Ad Networks is enabled, insert / remove cosmetic CSS on the active tab to hide
common third-party ad shells (YouTube, Search, Reddit, and similar). The CSS
path does not read page content or form fields. |
tabs |
Used in two queries: locating an open admin.lesuto.com tab to
postMessage saved configs to, and identifying the active tab's host so drafts
can be keyed correctly. The extension does not enumerate URLs of unrelated
tabs. |
webNavigation |
Used only to re-open Studio after a reload when the user enabled Keep Studio
open on this site. Listens for onDOMContentLoaded on the tab that
already had Studio, so the editor returns sooner than waiting for full page
load. Does not read page content. |
host_permissions: <all_urls> |
When the user turns the shield on, tracking interception must run on any website they visit. The Studio companion injects on the active tab only when the user clicks “Open Studio.” We never read page content, form data, or arbitrary cookies — only intercept outgoing tracking requests (when enabled) and append the studio script tag on demand. |
Four content scripts run as part of the extension:
fetch, XHR, sendBeacon, and tracking
function calls (gtag, fbq, ttq,
pintrk, dataLayer.push) to block tracking. Does not read
form data or cookies.
vendure-auth-token and vendure-selected-channel-token
from localStorage on the admin site and forwards them to the extension service
worker. Same origin the user is already signed in to.
When the user clicks “Open Studio,” the extension injects the
Studio editor from a file packed in the extension
(vendor/chameleon-studio.js). That copy is the same first-party
Lesuto editor used at
demo.lesuto.com/editor.
If the page already loads Lesuto chameleon.js, the extension
uses that live copy and does not inject an older bundled SDK. Pages without
an SDK receive the packaged vendor/chameleon.js and, when
needed, packaged vendor/hls.min.js (HLS playback). Those
files are in the zip. The bookmarklet and demo surfaces on www.lesuto.com
are websites, not this extension. The extension never modifies page content
beyond adding that script on explicit user interaction. Injection is
refused on browser-owned pages (chrome://, New Tab, Settings,
and similar).
Open Studio uses the packed files by default. The popup also offers
“Update to the latest SDK.” That control is off until the user
checks a disclosure and clicks Download latest. The extension then fetches
the same Toolkit-compiled chameleon.js and
chameleon-studio.js (remote script URLs compiled out) from
Lesuto’s first-party CDN
(cdn.lesuto.com/chrome-toolkit/vendor/), verifies SHA-256
against a JSON manifest, and stores them on this device. It does not load
website chameleon.js or Studio from www.lesuto.com. Use packed
version deletes the cache and returns to the zip copy.
Video playback uses a copy of hls.js packed as
vendor/hls.min.js. Open Studio does not fetch JavaScript until
the user opts in to Update to the latest SDK, and then only first-party
Toolkit files from cdn.lesuto.com.
This extension is a developer tool and is not directed at children under 13. We do not knowingly collect any information from children.
We may update this privacy policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of the extension after changes constitutes acceptance of the revised policy.
If you have questions about this privacy policy or the extension, contact us at:
Email: support@lesuto.com
Website: www.lesuto.com