HeaderDesk Privacy Policy
Last updated: Nov 2026 · Version 1.0.0
1. Introduction
This Privacy Policy describes how HeaderDesk (the "Extension"), developed by Iliass El Barhoumi, collects, uses, stores, and protects your information. This policy applies specifically to the HeaderDesk browser extension and is separate from the ExtensionShop marketplace privacy policy.
We are committed to protecting your privacy. By installing and using HeaderDesk, you agree to the data practices described in this policy.
2. Information We Collect
HeaderDesk collects the minimum data necessary to provide its functionality. Below is a complete breakdown of what data is and is not collected.
Data Collected
| Data Type | Description | Required |
|---|---|---|
| Profiles and settings (stored locally) | Your profiles, header rows and settings, and up to 10 automatic backups of them. Header values are stored as you typed them, because they are the rules. Kept in Chrome's extension storage on your device and never sent anywhere. | Required |
| Usage counts (stored locally) | When HeaderDesk was installed, how many successful changes it has seen, on how many days, and your answers to the optional support and rating cards. Numbers and times only, with no site names and no header data. They stay on your device. | Required |
| Check-view request logs (memory only) | The headers of requests that match your active rules, captured only while the Check view is open, with sensitive values masked. Kept in that view's memory, never written to disk, and gone when you close it. | Optional |
Data Not Collected
HeaderDesk does not collect the following types of information:
- Header values and tokens you type — they stay on your device, and exports mask sensitive values unless you choose to include them
- Page contents — HeaderDesk has no content scripts
- Browsing history — HeaderDesk keeps no list of pages
- Your Google account, name, email or any personal identifiers — there is no account
- Analytics, telemetry or crash reports of any kind
- Data sent to any server — there is no HeaderDesk server, and the only request it makes is the test request you click
3. How We Use Your Information
Collected data is used exclusively for the following purposes:
- Providing and maintaining the core functionality of HeaderDesk
- Saving your preferences and settings for a personalized experience
- Improving the extension through anonymous usage analytics (when you opt in)
- Diagnosing and fixing bugs or technical issues
We do not use your data for advertising, user profiling, or any purpose unrelated to the functionality of HeaderDesk.
4. Data Storage and Security
HeaderDesk stores data locally in your browser using the browser's built-in storage APIs (chrome.storage / localStorage). Data remains on your device and is not transmitted to external servers unless explicitly stated.
Data retention: Profiles, settings, backups and usage counts stay in your browser's extension storage until you change them or remove the extension, which deletes them automatically, and Chrome removes HeaderDesk's header rules with it. Check-view logs are gone when you close the Check view. Allowed sites are kept by Chrome as the extension's site permissions; remove them in HeaderDesk or at chrome://extensions.
5. Third-Party Data Sharing
None. HeaderDesk makes no network requests of its own and uses no analytics, SDKs or servers. The one exception is "Send test request", which sends one request to the address you typed, only when you click it. Two links open a normal browser tab only when you click them: the heart or tip button opens the developer's Ko-fi page, and the rating button opens HeaderDesk's Chrome Web Store page. HeaderDesk sends nothing to these sites. Exports are files you ask for, and are never uploaded.
We do not sell, rent, or trade your personal information to any third party for their marketing or commercial purposes.
6. Browser Permissions
HeaderDesk requests the following browser permissions. Each permission is required for specific functionality and is used only for its stated purpose:
| Permission | Purpose |
|---|---|
| Modify headers (declarativeNetRequestWithHostAccess) | The core of the extension: applies your header rules through Chrome's declarativeNetRequest API, and only on the sites you allowed. It has no install warning of its own. |
| Site access, only for the sites you allow (optional) | Nothing is granted at install. When you scope a profile, Chrome asks for the sites it targets and the site that makes the requests (Chrome needs both for fetch and XHR), or for all sites if you choose "All sites". Every allowed site is listed in HeaderDesk with a remove button. |
| Active tab | Reads the address of the current tab after you click the toolbar button, so HeaderDesk can offer "this site" as the scope of a new profile. It gives no access to the page itself. |
| Read request headers (webRequest) | Observation only, for the Check view: shows the request and response headers Chrome actually sent and received for requests that match your rules. It listens only while the Check view is open, never blocks or changes a request, and adds no install warning. |
| Storage | Keeps your profiles, header rows, settings, up to 10 automatic backups and a few local usage counts on your device. |
| Side panel | Lets you open HeaderDesk in Chrome's side panel as well as the popup. |
No permissions are used to collect data beyond what is described in Section 2 of this policy. We follow the principle of least privilege and only request permissions essential for the extension's functionality.
7. Your Rights
You have the following rights regarding your data:
- Access: You can view all data stored by the extension through your browser's extension storage inspector
- Deletion: You can delete all stored data by uninstalling the extension or clearing extension data in your browser settings
- Opt-out: Optional data collection (such as analytics) can be disabled in the extension settings
- Portability: You may export your data where the extension provides export functionality
- Complaint: You have the right to lodge a complaint with a data protection authority if you believe your rights have been violated
For users in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to rectification, restriction of processing, and the right to object. To exercise these rights, contact us using the information below.
8. Children's Privacy
HeaderDesk is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the extension's functionality or applicable regulations. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we will provide notice through the extension's update notes or a notification within the extension itself.
Your continued use of HeaderDesk after changes are posted constitutes your acceptance of the updated policy.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the data practices of HeaderDesk, please contact us:
Developer: Iliass El Barhoumi
Email: iliasselbarhoumi@gmail.com
Website: https://www.extensionshop.store/extension/headerdesk