Header Handler — Privacy Policy

Last updated: 2026-07-11

Header Handler is a Chrome extension that lets you add, overwrite, and remove request headers using rules you define. This page explains, in plain English, what data the extension touches, where it lives, and where it never goes.

What is stored, and where

Your configuration — profiles and the header rules inside them — is stored using chrome.storage.sync. This is Chrome's built-in synced storage: if you're signed into Chrome, this configuration will sync across your Chrome instances on other devices, the same way bookmarks or extension settings do. This data is managed entirely by Chrome; Header Handler does not run its own server and cannot see this data outside your browser. (Chrome's synced storage caps a single item at 8 KB, and the whole configuration is stored as one item. Header Handler compresses the configuration before storing it, which raises that effective limit, but there is still a practical ceiling on how much you can save; the options page warns you as you approach it. Compression is a storage-format detail only — the data stays in Chrome's synced storage and is not sent anywhere.)

The live log and sensitive headers

The live log observes request headers for requests that match your enabled rules — and this can include sensitive headers, such as Authorization and Cookie, if your rules cause a request to be observed.

Header Handler only looks at headers on requests that match a rule you turned on. It does not inspect or log traffic outside of that matched set.

Anything the live log captures is held only in chrome.storage.session — Chrome's in-memory, session-scoped storage. Concretely, that means:

Observed headers live in memory for the duration of your browser session.
They are never written to disk.
They are never transmitted anywhere — not to a server, not to any third party, not anywhere off your device.
They are cleared automatically when the browser closes, and can be cleared manually at any time with the Clear button in the live log.

What Header Handler does not do

No analytics.
No tracking.
No remote code — everything the extension runs ships in the extension package itself.
No network requests of its own. Header Handler does not phone home, check for updates outside Chrome's normal extension update mechanism, or send any data anywhere.

Limited Use

Header Handler's use of the data it handles complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Concretely:

The request headers and URLs the live log observes are used only to provide the extension's user-facing features — showing you which of your enabled rules matched a request. They are not used for any other purpose.
This data is never transferred to anyone, and never sold. It stays in your browser's in-memory session storage and is cleared when the browser closes.
It is never used for advertising, ad targeting, or any form of personalized/re-targeted/interest-based advertising.
No human ever reads it — there is no server, no account, and no back end that could receive it.

Summary

Your profiles and rules sync via your Chrome account, exactly like other Chrome settings. The live log's view into request headers — including sensitive ones — is limited to requests matching your own enabled rules, stays in memory for the current browser session only, and is never sent anywhere. That's the entire scope of what this extension touches.