Privacy Policy: API Failure Investigator

Effective date: 2026-11-01

API Failure Investigator is a Chrome extension that helps developers investigate failed web API requests. It is designed to work entirely inside your browser.

What the extension accesses

Only after you click Record, and only for the tab that was active when you did, the extension reads:

• network requests made by the page (Fetch, XMLHttpRequest, documents, scripts, stylesheets, fonts, images and media): URL, method, request headers (without cookies), request body, status code, response headers, and timing. Response bodies are read for everything except images, fonts and media, and each body is cut at 10,000 characters;

• console errors, console warnings and uncaught exceptions from that page.

It reads this through Chrome's debugger permission. While it is active, Chrome shows a "started debugging this browser" banner and the extension's toolbar icon shows a red REC badge. Capture stops when you click Stop, cancel the banner, or close the tab. Closing the side panel does not stop it: use the red REC button to stop.

Where the data goes

• Nowhere, unless you send feedback. The extension makes no network requests of its own, except when you press Send: in the Feedback form (see "Feedback" below), or in the Test view, which resends the request you edited from your recorded tab to that request's own server, exactly as your app would. It has no account system, no analytics and no tracking.

• Captured data is kept only in the memory of the extension's background process. It is never written to disk or browser storage. It is deleted when you click Clear, start a new recording, or quit the browser. After a recording has stopped, it is also discarded shortly (about 30 seconds) after the last side panel or window of the extension is closed.

• While the panel is open, a secret can be shown on screen if you switch on Show secrets. It is off by default and resets every time, and copied reports are redacted either way.

• The only things stored on your device (in the browser's local storage for this extension) are your preferences: the slow-request threshold, any extra field names you ask to be redacted, and whether you have seen the welcome and the first-use tips. They contain no captured traffic.

• In the Test view, a hidden credential (token, password or API key) is only reused for the site it was recorded on. The Copy secret button next to a hidden value puts the real value on your clipboard when you click it. Nothing else copies a real credential.

• Data leaves the extension only when you click Copy report or Copy JSON, or press Send in the Feedback form (see below), or use Copy secret as described above. The extension then places a report on your clipboard. Before copying, it masks values that look like credentials (for example Authorization headers, cookies, tokens, API keys and passwords). This masking is pattern-based. Review a report before sharing it.

Feedback

The Feedback button in the panel header opens a small form. Nothing is sent until you press Send. The form is then posted to a Google Apps Script owned by the developer, which emails it to astracore.dev@gmail.com. Google processes it under Google's terms. The email contains:

• the type (Bug, Idea, Support or Other) and the message you wrote;

• your name and email address, only if you type them (both are optional; the email is used only as the reply address). They are not stored by the extension;

• the extension version and your browser's user agent;

• the incident report, only if you tick "Attach the open incident". It is the same redacted report that Copy report produces, so it still contains the URLs and bodies of the request you were investigating. Review it before sending.

Nothing is sent unless you press Send.

Permissions

• debugger: Read network and console events of the tab you choose to investigate.

• sidePanel: Show the investigation panel next to the page.

Data sale and sharing

We do not collect, sell or share any user data.

Changes

If this policy changes, the new version will be published at this address with a new effective date. A future version that sends any data off your device (for example, optional AI analysis) will require you to turn it on explicitly first.

Contact

Questions or privacy requests: astracore.dev@gmail.com