Here is the full list of permissions that the ORGanizer requires to work on your browser:

• Read and change data on a number of websites: This is the list of domains that the ORGanizer needs to be injected into:
  • force.com, salesforce.com, visualforce.com, documentforce.com, salesforce-communities.com: main Salesforce domains
  • organizer.enree.co: This is the main ORGanizer site, used only to get the latest news
  • organizer-api.enree.co: Promo Code verification endpoint. This endpoint is called only after Promo code validation (if any)
  • www.googleapis.com: Google analytics endpoint
• Read your browsing history: needed to monitor browsing through Salesforce pages
• Communicate with cooperating websites: this permission is necessary to enable the Javascript APIs (that you want to explicitly enable from the Options page)
• Read data that you copy and paste: access to the browser's clipboard (used among all on the custom console plugins to copy Salesforce ID on the clipboard)
• Manage your downloads: needed to trigger local file download
• Know your email address: needed to get your email address for Promo Code verification (your email address is never sent to anyone but only used to validate your codes, if any)