# Privacy Policy for Header Shield

Last Updated: August 15, 2026

Header Shield is committed to protecting your privacy. This privacy policy describes how the extension handles user data.

## 1. No Data Collection or Transmission

Header Shield is a local-first browser extension. 

* All HTTP response header analysis is performed locally in your browser.

* No data (including URLs visited, header values, or reports) is ever sent, transmitted, or shared with any external server or third party.

* The extension has no external telemetry, tracking, or network communication code.

## 2. Data Accessed and Stored

* **Web History (Active URLs):** The extension reads the active tab's URL strictly to identify the page being audited and associate findings with that domain.

* **Website Content (HTTP Headers):** The extension reads HTTP response headers to run security checks. It does not inspect HTML body content, user forms, page text, or script content.

* **LocalStorage:** Saved reports and the list of ignored findings are stored locally on your device using `chrome.storage.local`. This data remains on your machine until you delete it or uninstall the extension.

* **Cookie Protection:** While the extension checks Set-Cookie headers for security attributes (like Secure and HttpOnly), it explicitly strips and ignores cookie values to ensure session data is never processed or exposed.

## 3. Policy Changes

If we update this extension to change how data is processed, this policy will be revised. However, our commitment to keeping all security analysis completely offline and local will not change.

## 4. Contact

For any questions regarding this policy, please open an issue in the project repository.