You can look at the code (either at https://github.com/kkapsner/CanvasBlocker/ of you can download the xpi-file, change the extension to zip and look at the content). It does not store any private information or sends anything to a server.

UPDATE: I just realized I did not answer the question. The addon does not need access to login information (and does not use it). But there is no techical difference between the information the addon needs access to (the canvas and JS that are used for fingerprinting) and other information. I would gladly only take the permission to access the information that I only need - it's just not possible.