Privacy Policy - Header Lens

Last Updated: October 2026

Header Lens is a privacy-first Chrome extension.

This page has a plain-language summary (below) and a technical breakdown — see Privacy in detail to verify exactly how the extension handles data.

Data Collection

• Header Lens does not collect, transmit, or sell any user data.
• Rules are applied by the browser itself (declarativeNetRequest); the extension never observes, reads or logs your requests or responses.
• No data is sent to external servers or third parties.
• No tracking, no analytics, no telemetry, no cross-device sync.

Storage

• Your header rules, profiles and preferences (theme, value masking) are stored locally in extension storage.
• Rules and profiles necessarily contain the header values you typed — including any credential you chose to inject — stored only on your device, never sent anywhere.

Changes to This Policy

We may update this policy occasionally. Continued use of the extension constitutes acceptance of any changes.

For questions, contact: [email protected]

---

Privacy in detail

Where data lives

Header Lens uses browser-managed storage and nothing else.

• Local (chrome.storage.local) — survives a browser restart: header rules, profiles, the pause flag, theme and masking preference. Rules and profiles store header values by necessity — that is what gets injected.
• Browser rule engine — the enabled rules are installed as declarativeNetRequest dynamic rules, which Chrome keeps in its own profile storage and applies without involving the extension.
• In memory only — the origin of the tab a surface is scoped to, while that surface is open.

Nothing is written to session storage, IndexedDB or any file unless you export.

What the extension can see

• The origin of the tab you open a surface on (https://host/) — to scope the rule list and the access request. The background resolves the tab and hands the UI the origin only; the path and query string never reach it.
• Whether that tab is incognito, so the forms can remind you that a rule or profile created there still persists to disk.

It does not read page content, request or response bodies, cookies, history, bookmarks, passwords or other extensions' data.

Incognito

Rules apply in incognito windows once you enable Allow in Incognito. The extension's storage is shared between normal and incognito windows (Chrome's "spanning" mode), so a rule or profile created from an incognito tab keeps that site's name on disk — the Add form, editor and Profiles view say so while you're in an incognito window.

Message authentication

Background messages are authenticated by sender id, so only the extension's own surfaces can change rules. The extension exposes no external messaging.

Permissions

Permission	When granted	What it allows
declarativeNetRequest	On install	Install the header rules you create as dynamic rules
storage	On install	Persist rules, profiles and preferences locally
tabs	On install	Resolve the inspected tab's URL to scope the DevTools panel list
activeTab	On install	Scope the popup to the tab you invoked it on
sidePanel	On install	Open the same app as a side panel
<all_urls> host access	Per site, from your click	Let a rule modify that site's headers

Host access is optional and requested per site from a user gesture — it is not part of the default install. You can revoke it any time from Settings → Site access or at chrome://extensions. A rule only ever fires on sites you granted.

Exports are your responsibility

Export produces JSON files containing the header values you configured — including auth tokens and API keys if you injected them. Header Lens asks before exporting or copying credential-like values, and then the file is fully under your control.

Data retention

Data	Lifetime	How to clear
Header rules	Until you delete them or uninstall	Delete the rule, or uninstall
Profiles	Until you delete them or uninstall	Delete the profile, or uninstall
Preferences	Until you change or uninstall	Uninstall the extension
Tab origin (in view)	While the surface is open	Close the popup / DevTools / side panel
Exported files	Up to you	Manual deletion

What Header Lens does not do

• Does not contact any remote server.
• Does not include analytics, telemetry, or crash reporting.
• Does not sync anything across devices.
• Does not load any third-party scripts or fonts.
• Does not observe, log or block any request; it only installs the rules you wrote.
• Does not require an account, login, or any personal information.