The Alby browser extension is a fully client side application. No data is shared with any party externally. Ally data is stored locally. You can have a look at the open-source code. But I agree it might be a bit surprising why all these permissions are needed. Here you can read more about it: https://guides.getalby.com/user-guide/alby-browser-extension/faqs/what-permission-does-the-extension-require