Data is synced from the Chrome Web Store. View the official store page for the most current information.
The extension injects the Zilliqa web3 API into every website's javascript context, so that dapps can read from the blockchain.
ZilPay also lets the user create and manage their own identities (via private keys, local client wallet and hardware wallets like Ledger), so when a Dapp wants to perform a transaction and write to the blockchain, the user gets a secure interface to review the transaction, before approving or rejecting it.
Because it adds functionality to the normal browser context, ZilPay requires the permission to read and write to any webpage. You can always "view the source" of ZilPay the way you do any Chrome extension, or view the source code on Github: https://github.com/zilpay/zil-pay