PRIVACY POLICY - HEADERMOD EXTENSION
Last updated: October 2026
HeaderMod ("we", "our", or "the extension") is an open-minded, privacy-respecting developer utility designed to modify HTTP request and response headers. We believe your development workflow, testing tokens, and browsing activity are strictly your own business.
This Privacy Policy explains how HeaderMod handles user data, why specific browser permissions are requested, and directly answers whether all requested permissions are strictly necessary.
================================================================================
1. ZERO DATA COLLECTION & 100% LOCAL PROCESSING
================================================================================
• No Personal Data Collection: HeaderMod does not collect, record, log, or transmit any personal information, browsing history, visited URLs, IP addresses, or HTTP payloads.
• No External Network Calls: HeaderMod operates 100% locally on your machine. The extension does not communicate with any external analytics servers, tracking platforms, or third-party cloud backends.
• Local Storage Only: All custom headers, rule configurations, profiles, and preferences you create are saved exclusively in your browser's local storage (`chrome.storage.local`). They never leave your computer unless you explicitly export them to a file yourself.
================================================================================
2. PERMISSIONS BREAKDOWN & WHY THEY ARE NEEDED
================================================================================
To modify HTTP headers in Google Chrome's modern Manifest V3 architecture, Chrome requires explicit permission declarations. Below is a detailed breakdown of each requested permission:
1. "declarativeNetRequest"
• Purpose: This is Chrome's official, high-performance, and privacy-preserving API for modifying network requests.
• What it does: It allows HeaderMod to pass declarative rules (e.g., "add Authorization header" or "set Access-Control-Allow-Origin to *") to Chrome's native network engine.
• Why it protects you: Unlike legacy APIs (such as webRequestBlocking), declarativeNetRequest does NOT give the extension access to read the contents of your web pages, inspect full response bodies, or inspect confidential network streams. Chrome's native engine executes the rules internally, ensuring optimal speed and maximum security.
2. "storage"
• Purpose: Allows the extension to persist your configuration.
• What it does: Saves your custom profiles, header names, header values, URL filters, and active/paused toggle state across browser sessions.
• Scope: Data is written strictly to `chrome.storage.local` on your local disk.
3. Host Permissions ("*://*/*")
• Purpose: Allows the declarative rules to take effect across websites and API servers.
• What it does: Developers frequently test headers against local servers (localhost), staging environments, microservice clusters, and third-party APIs. Without host permissions, Chrome's network engine will refuse to apply header modifications to incoming or outgoing requests on those destinations.
================================================================================
3. ARE ALL THESE PERMISSIONS STRICTLY NECESSARY?
================================================================================
YES, every requested permission is strictly required for the extension to fulfill its core purpose, and not a single unnecessary permission is requested. Here is why:
• Can we remove "declarativeNetRequest"?
No. Without `declarativeNetRequest`, Chrome provides no mechanism to modify, inject, or remove HTTP headers in Manifest V3. It is the core engine of the extension.
• Can we remove "storage"?
No. Without `storage`, every time you close the popup or restart your browser, all your custom headers, profiles, and API tokens would be permanently wiped out.
• Can we remove Host Permissions ("*://*/*")?
No. In Chrome Manifest V3, `declarativeNetRequest` rules can only modify headers on domains where the extension has host permissions. Because HeaderMod is a general-purpose developer tool used across arbitrarily different APIs, local servers (localhost), staging domains, and testing environments, broad host permission is technically mandatory for the rules engine to function on the domains you choose to test.
We have intentionally avoided requesting invasive permissions such as `webRequest`, `cookies`, `tabs`, `management`, or `identity`. HeaderMod adheres strictly to the principle of least privilege.
================================================================================
4. THIRD-PARTY SERVICES & ANALYTICS
================================================================================
HeaderMod does NOT embed any third-party advertising SDKs, tracking libraries, error-tracking scripts (e.g., Sentry), or analytics platforms (e.g., Google Analytics). Your development headers, secret tokens, and session parameters remain completely private on your workstation.
================================================================================
5. DATA SECURITY & RETENTION
================================================================================
Since all configuration data is stored locally in your browser's sandboxed storage, you have total control over it. You can modify, clear, export, or permanently delete all stored headers and profiles at any time through the HeaderMod popup interface or by uninstalling the extension.
================================================================================
6. CONTACT & TRANSPARENCY
================================================================================
If you have any questions or feedback regarding this Privacy Policy or HeaderMod's technical implementation, please feel free to reach out via our Chrome Web Store support listing or project documentation page.