extension privacy

Last updated 16 October 2026

What this covers

The Theia Scanner Relay is a Chrome extension published by Theia Vision, Inc. and used by warehouse staff at organisations that run Theia. It tells Theia when the operator reaches an order's pack page in a warehouse management system (WMS), so the glasses record that pack against the right order, and it types what the operator scans with the glasses into the WMS. This page describes what it reads, what it sends, what it types, what it stores, and what happens to that afterwards.

What it reads

The extension may run on any site, but it acts only on the sites Theia's rules name, today pages under app.packiyo.com. Theia publishes those rules as one file the extension downloads. On a site the rules name, it reads only the fields a rule picks when an event the rule names fires in the page: parts of the page's own web address, such as its site and path; whether the browser is online, and its language, user-agent and platform; or a plain value the event itself carries. It cannot read the page's text, its form contents, its cookies or storage, or anything in another tab. Today's rules pick the site and path of an order's pack page each time it loads or the browser restores it from its back/forward cache, and whether it was restored. No rule can name a keystroke, text-input, clipboard or selection event, and the extension refuses one, so what the operator types is not observed at all. A rule may also have the extension observe the web requests the browser makes to the https addresses it names, without blocking or changing them, reading only the fields it picks from each, such as the request's address, method and status, and never its headers or contents; today's rules name none. The extension checks each event against the rules on the operator's computer, and for an event no rule matches it sends nothing. A second script runs on Theia's own site to tell Theia's console whether the relay is connected and which relay it is; it carries no pack data.

What it sends

When an event matches one of Theia's rules, the extension sends Theia the rule's name, the fields it picked, when it saw the event and which version of the rules it used. Today that is an order's pack page on app.packiyo.com: the site the page is on, such as app.packiyo.com, its path, such as /packing/single_order_shipping/19188, and, on a restore, that the page was restored. The query string and fragment are sent only if a rule picks them, and today's rules do not. Theia takes the order's identifier from the path, compares the site against the WMS the organisation connected, and records nothing when they differ. The extension sends each event with its relay token, a credential Theia issues to the relay for ten minutes at a time and only while the relay is paired with the operator's glasses, so the pack is attributed to the operator who paired them. To get a token, it sends Theia its relay id with the session cookie the operator already holds from signing in to Theia in the same browser profile, along with that it is the extension, its version, and details of the browser it runs in: the operating system and its architecture, the browser's brands and their versions, its platform, whether the device is mobile, the browser's user-agent, and the language of its interface. Theia keeps the latest of these on its record of that relay. The extension also sends that cookie when Theia's console asks whether the relay is connected. To receive scans, it keeps a connection open to AWS IoT, Amazon Web Services' messaging service, signed in as its relay id with its relay token, and listens only for messages addressed to that relay. It downloads Theia's rules from Theia's content delivery network with no cookie and no identifier, sending only a tag for the copy it already holds so an unchanged file is not sent again. Every request it makes to Theia names the extension's version.

What it types

When the operator scans a barcode with the glasses paired to the relay, Theia sends its value to the relay over AWS IoT. The extension types the value into the tab in front of the operator, followed by Enter, only if that tab is a secure (https) page on a site Theia's rules name for typing, today pages under app.packiyo.com, and only while that page is focused, visible and loaded, within five seconds of reaching the extension, the limit today's rules set. Otherwise it types nothing and shows a Chrome notification naming the value and why it was not entered. The extension does not store the value or write it to its logs.

What it is for

Reaching an order's pack page marks when that pack begins, and reaching the next one marks when it ends. Theia asks the organisation's WMS which tote holds the order and what number the WMS has for it, names the recording after the tote, and keeps the number, so the recording can be found later by it. Typing a scan enters what the glasses scanned into the WMS, as a handheld scanner would.

What the extension stores

In the browser's local storage, the relay id that connects it to the operator's glasses, kept until the extension is removed. In the browser's session storage, which the browser clears when it closes: the current relay token and when it expires, Theia's rules with the tag for that copy, which notice it last showed, and the timers that pace its connection to AWS IoT. The extension keeps no database and stores no queue: an event or a scan waits only in memory while it is sent or typed.

What Theia keeps

A relayed order identifier, and the number and tote the organisation's WMS reports for it, become part of the warehouse records held by Theia Vision, Inc., which decides who may see them and keeps them indefinitely; nothing on this path is deleted or expires. Theia also keeps a record of each relay an organisation uses: its id, that it is the extension, its version, the latest browser details it reported, the pairings it served, and when it was first and last seen, refreshed at most hourly while nothing else changes; this record is not deleted either. On its way from the glasses to Theia, a scanned value waits, with the glasses' id, in an Amazon SQS queue, which deletes it once Theia has handled it and otherwise after 40 minutes; a scan Theia fails to handle three times moves to a second queue, which keeps it for four days, AWS's default. Our application logs record the order identifier alongside the operator, pairing and capture it belongs to, and record the relay id with each token request and each scan sent to it. When a page is refused because its site differs from the connected WMS, application logs also record both hosts. The extension's diagnostic logs in the browser record the page's site, without its path, query string or fragment, and the platform we run on records the IP address, browser user-agent, path and status of each request the extension makes.

Who else sees it

Theia runs on Railway, which hosts the application, its database and its video storage, and whose logs record each request. Application logs are shipped to Grafana Cloud, and errors, with the details of the request that raised them, are reported to Sentry. Amazon Web Services runs AWS IoT, which carries each scanned value from Theia to the relay and sees the relay's id and token, and serves Theia's rules from Amazon S3 through Amazon CloudFront, which receives each request for them. Signing in is handled by WorkOS, which holds the operator's name, email and session. The order identifier is sent to the organisation's own warehouse management system to resolve which tote holds that order and what number it has. We share it with no one else.

What we do not do

We do not sell or rent this data or use it for advertising. The extension carries no analytics and no third-party tracking.

Changes

We revise this page whenever the relay's behaviour changes; the date at the top is the last revision.

Questions

Email team@theia-vision.com.