Is LanceRank Sync safe to install? Yes — and here's exactly why.
We built this extension because we wanted one we could trust on our own freelance accounts. So we made it impossible for it to do anything risky. This page exists for the most paranoid freelancers — every permission, every byte that leaves your browser, and how to inspect it yourself.
Is this safe? Yes — here's exactly why.
We built this extension knowing freelancers are (rightly) paranoid about their platform accounts. So we made it impossible for it to do anything risky. Plain English below — no marketing.
What it does
- Reads your own profile page — only when you open it
- Sends those stats to your LanceRank account
- Talks only to lancerank.com — no third parties
- Can be turned off in one click from your dashboard
What it can't do
- Log in for you, or see your platform password — ever
- Post, message, change, bid, or click anything on the platform
- Read your inbox, jobs feed, or any tab you didn't open yourself
- Run on your bank, email, or anything outside freelance platforms
From the platform's perspective (Upwork, Fiverr, Freelancer.com, PeoplePerHour, Guru, Toptal, Contra, 99designs): nothing changes. The extension never makes new requests to the platform — it only reads the page your browser already loaded as a normal logged-in user. There is no automation, no scraping, no clicking, no bot behaviour. To the platform you're just a person looking at your own profile.
What the extension can access
A browser extension is sandboxed by Chrome to only the URLs declared in its manifest. Here's what's in our manifest — and nothing more works.
The extension is granted access to the currently active tab (via activeTab) plus a strict allow-list of freelance-platform host patterns. When you visit one of those URLs, a small content script runs on that page only.
https://www.upwork.com/freelancers/*Upwork freelancer profile pageshttps://www.fiverr.com/*Fiverr profile pageshttps://www.toptal.com/*/resume/*Toptal résumé pageshttps://www.freelancer.com/u/*Freelancer.com user pageshttps://www.peopleperhour.com/freelancer/*PeoplePerHour freelancer pageshttps://www.guru.com/freelancers/*Guru freelancer pageshttps://contra.com/*Contra profile pageshttps://99designs.com/profiles/*99designs profile pageshttps://lancerank.com/extension/connectOne LanceRank page — only to receive the auth token you grant
Even on those pages, the extension only extracts data after a same-origin ownership check (e.g. Upwork's own "edit profile" controls present, a session cookie indicating you're the profile owner, etc.). Browsing other freelancers' profiles produces zero data, zero requests, zero anything.
What it can't access
Chrome's extension sandbox makes the rest physically impossible — even if our code tried to do these things, the browser would block it.
- Other browser tabs you have open
- Your saved passwords or autofill data
- Your platform login session cookies (we read the page, not the cookie jar)
- Messages, inboxes, job feeds, financial transactions on the platform
- Other freelancers' profiles you happen to view
- Your bank, Gmail, social media, or anything outside the platform allow-list above
- Your browsing history or bookmarks
- Your camera, mic, location, downloads, or filesystem
Where the data goes
There is exactly one outbound destination from the extension.
Authorization: Bearer <your-personal-token>
That's it. No analytics services, no error trackers, no third-party CDNs, no advertising pixels. One endpoint, on the same domain you're already using, authenticated with a token tied to your own account.
The token is created when you click Authorize on lancerank.com/extension/connect. Stored in chrome.storage.local on your device. Revocable instantly from your dashboard — when you revoke, the next sync attempt fails immediately.
The payload contains only the public stats from your own profile page (name, rating, review count, jobs completed, badges, member-since date, etc.). Reviewable byte-for-byte in DevTools → Network — see the "Inspect it yourself" section below.
How to inspect it yourself
Don't take our word for any of this. Verify in 3 minutes.
- 1
See exactly what landed on your profile
Sign in and open your sync history. You'll see every sync the extension has ever sent: the timestamp, the platform, the URL it ran on, and the exact fields it imported into your LanceRank profile. Nothing is hidden — what isn't in the list never reached us.
- 2
Watch the network tab
Open Chrome DevTools (
Cmd/Ctrl+Shift+I) → Network tab. Visit your Upwork/Fiverr profile while logged in. Filter bylancerank.com. You'll see exactly one POST request to/api/extension/syncwith the JSON payload. That's the entire transmission. - 3
Check the manifest
Visit
chrome://extensions, find LanceRank Sync, click "Details", scroll to "Site access". You'll see the exact list of URLs from section 1 above. Chrome enforces these — even our own code can't reach beyond them. - 4
Try uninstalling
Sections 7 below. The extension stops syncing instantly. Your existing LanceRank profile is unaffected. Reinstall any time and pick up where you left off.
Every permission, explained
When you install the extension, Chrome shows you a list of permissions. Here's the full list and what each one is for.
storageStores your authorization token locally on your device, in chrome.storage.local. Without this, you'd have to re-authorize every time you opened a new browser session.
activeTabGives the extension permission to read the page in the currently active tab — but only if it matches one of the host patterns below, and only when you're actively on that tab. The lightest-touch tab access permission Chrome offers.
scriptingUsed only by the popup's 'Sync this page now' button. Lets us inject the platform-specific reader script into the active tab on demand if it isn't already loaded. Doesn't grant access to any URL not already covered by host_permissions.
host_permissionsThe exact list of platform URLs declared above. Chrome blocks the extension from running anywhere else. This is what actually constrains the extension's reach — not a loose 'all sites' grant.
Notably absent: tabs, cookies, history,bookmarks, downloads, webRequest,identity, nativeMessaging — none of these are requested.
Design choices that protect you, not us
The constraints below were deliberate — they make even malicious code we hypothetically shipped unable to harm your platform account.
No new requests to platforms. The content scripts read the DOM your browser already rendered. They never
fetch()orXMLHttpRequestback to the platform. No automation footprint. From Upwork's logs we look like any other person who loaded their own profile page.Ownership checks before any extraction. On every supported platform, the script first verifies that the page isyour ownprofile — using signals only the page owner sees (e.g. an "Edit profile" button, a `me` route response, or a session indicator). Browsing competitors' profiles silently does nothing.
No password handling, ever. The extension never has a text field for, asks for, or sees your platform password. Authentication piggy-backs on your existing logged-in browser session — the same session you'd use without the extension.
One-tap revocation. One click in your LanceRank dashboard kills the token. The extension installed in any browser, on any device, immediately stops being able to sync. The Chrome extension itself can keep running — it just won't be able to authenticate.
Per-user, per-sync transparency. Every sync the extension performs is logged against your account and visible to you in your sync history. If something ever shows up there that you didn't expect, you'll see it immediately — and the Chrome Web Store independently reviews each published version of the extension before it can update on your machine.
How to uninstall (3 lines)
No goodbye dialogs, no retention loops. If you change your mind:
- Right-click the LanceRank Sync icon in your Chrome toolbar.
- Choose "Remove from Chrome…".
- Confirm. Done.
Your existing LanceRank profile and all already-synced stats stay where they are. To also revoke the device's access on the server side (recommended), visit /dashboard/extension and click Revoke next to the device.
Comfortable now?
Install in one click. Free forever. Uninstall any time.
Still have questions? Email us — every reply comes from a human.