Purpose
This policy covers the Header Relay Chrome extension and its documentation website. The extension helps developers inspect browser-based HTTP requests when fixed or captured headers are attached.
Host permissions
The extension includes access to http://localhost/* for its default local-development workflow. Every other host permission is optional and requested only when you add its Target Origin. Header capture and attachment remain limited by enabled profiles, Target Origins, and Excluded Paths.
Data stored locally
Profile settings and a randomly generated UUID v7 analytics client identifier are stored in the extension's local browser storage. Captured header values and runtime session state stay only in in-memory session storage. Diagnostic audit logs use IndexedDB without header values or persistent request URLs. Captured values are masked by default and require an explicit reveal or copy action.
Limited use
Browser permissions and locally stored data are used only for the extension's single purpose: capturing configured response header values and relaying configured request headers for developer-selected target origins. The data is not used for advertising, creditworthiness, lending, or unrelated purposes.
Data sharing
The extension does not transmit profile settings, audit logs, usage events, analytics client identifiers, browsing data, or captured headers to the developer, analytics providers, or unrelated servers. Configured header values are transmitted only as part of matching requests to the Target Origins you selected.
No human access
Through the extension, the developer does not receive, inspect, sell, or share profile settings, captured values, audit logs, usage events, analytics client identifiers, or browsing activity. Locally stored copies remain in the Chrome profile; configured header values are disclosed only to matching Target Origins.
Website analytics
When you consent, this documentation website loads Google Analytics 4 (GA4) to measure page views and aggregate usage. GA4 may process the page URL, referrer, approximate location, and browser and device information, and may set first-party analytics cookies prefixed with hr. The cookies are limited to this website's /header-relay path. Google Signals and advertising personalization are disabled. The tag is not loaded when you decline. Your choice is stored in localStorage and can be changed using Analytics settings in the footer. Extension profiles, configured or captured header values, audit logs, and browsing activity are never sent to GA4.
Extension analytics
Production builds create the local analytics client identifier but do not emit usage events or transmit analytics data. Local development builds started with pnpm dev write a limited set of typed, non-sensitive events to the Service Worker console only. Adding external analytics to the extension will require this policy and the Chrome Web Store disclosures to be updated before release.
Audit log retention
Diagnostic audit logs are capped at the 1,000 most recent entries, and entries older than 7 days are removed automatically. Request URLs are not persisted with audit logs. The current browser session keeps only the origin and pathname for recent-log display. All audit logs can be removed from the management screen.
Your control
You can disable a profile, remove target origins, clear captured values, or uninstall the extension to stop capture and attachment behavior.