Massive Instagram Saver

Host permission justification (www.instagram.com, *.cdninstagram.com, *.fbcdn.net): This extension only operates on Instagram. Host permission on www.instagram.com is required to inject the download UI into profile/story/highlight pages and to call Instagram's own private web API (same-origin, using the user's existing session cookie) to enumerate a profile's posts, stories, and highlights. Host permission on *.cdninstagram.com and *.fbcdn.net (Instagram's media CDN) is required to fetch the actual photo/video bytes so they can be saved to disk — the CDN rejects cross-origin download requests without it. No other domain is accessed. Remote code justification: This extension does not fetch, eval, or execute any remotely hosted code. All JavaScript, including the script injected into the Instagram page to observe its API calls, is bundled inside the extension package at build time and loaded only via chrome.runtime.getURL() (a local packaged file). Nothing is downloaded from a server and executed at runtime. Storage justification (storage permission): chrome.storage.local stores a single value: the user's light/dark theme preference, so it stays in sync between the toolbar popup and the in-page download modal. No personal data, credentials, or downloaded content is stored. Single purpose description: Lets a user download Instagram posts, carousels, stories, and highlights they can already view, individually or in bulk, from a profile page to their own computer. Rest — certifying data-usage compliance (checkbox) and verifying publisher contact email — account actions only you can do, on the Settings/Privacy practices tabs.