When first installed, QuicKey asks for these permissions:
QuicKey uses this permission to let you search the titles and URLs of the open tabs, as well as pages from your history. The "all signed-in devices" part is there only so that recently closed tabs can be restored with their full history. The only time QuicKey changes your browsing history is when you choose to delete a history item.
QuicKey uses this permission to let you search the titles and URLs of your bookmarked pages. The only time it changes your bookmarks is when you choose to delete one.
QuicKey does not request the Read and modify all your data on all websites you visit permission that many extensions require, so it can't read or modify the content of any pages you visit. It doesn't transmit any information other than some anonymized diagnostic data. It never sends anything about the pages you visit.
If you right-click the QuicKey icon on the toolbar, there's a message saying Can't read or change site's data, which is a bit misleading, since it can't read or change any site's data, not just the current one.
The complete QuicKey source code is available for inspection on GitHub.