Diarea collects nothing.

Not your browsing, not the pages you scan, not your findings. There is no account, no server and no analytics. The only thing that leaks here is your frontend, and only to you.

The Chrome extension

It runs only when you click its icon, and only on the tab you are looking at.
It reads that page (its scripts, markup, page globals, the field names of its boot data and the names of its local storage keys, never their values) inside your browser, scores it and shows you the report. The report stays in the popup and disappears when you close it.
To read a page's own JavaScript files it may fetch them again from that same website, without your cookies, and check whether a source map file sits beside them. Diarea has no server of its own.
If the page loads its own scripts from a CDN (such as cdn.example.com for www.example.com), the popup offers to read those too. Only if you click does Chrome ask you for that one site, and only then does Diarea fetch those script files, without your cookies, in the same way. Scripts from other companies (analytics, payment widgets, public libraries) are never offered and never read.
It stores nothing: no history, no settings, no cookies, no local storage.
It does not change the page, and it does not sell, share or transfer any data, because it never has any.

Permissions, and why

activeTab: lets Diarea read the current tab, and only after you click the icon. It has no access to any other tab or site.
scripting: runs the read-only scan inside that tab so it can see what the page exposes.
Optional site access: nothing at install. Requested one site at a time, only when you click to read a page's own CDN scripts. You can remove it at any time from the extension's details page in Chrome.

The CLI, the agent server, the GitHub Action and this website

The command-line tool runs on your machine and sends nothing anywhere. The same goes for the MCP server your coding agent can start (diarea mcp): it runs locally, only scans what the agent asks it to (files inside the project, and public sites unless you allow private addresses), and hands back the report with secrets redacted. A login saved with diarea login stays in a file on your machine. What your agent then does with that report is up to your agent and its own privacy terms. The GitHub Action runs in your own GitHub workflow; on pull requests it posts the score as a comment on that pull request, using your workflow's own token.
This website sets no cookies and loads nothing from other sites. The one exception is the videos: if you press play on one, that video loads from YouTube's privacy-enhanced player, under Google's privacy policy.

Secrets

When Diarea finds something that looks like a key or token, it shows only a short prefix and the length, never the full value, in every report it produces.

Questions

Diarea is open source, so you can read exactly what it does in the source code. For anything else, open an issue.