# HeaderDesk Privacy Policy

> What HeaderDesk collects, what it never collects, and where data goes.

Source: https://www.extensionshop.store/extension/headerdesk/privacy
Markdown: https://www.extensionshop.store/extension/headerdesk/privacy.md

This is the privacy policy for **HeaderDesk** — Modify HTTP request and response headers, per site. The extension page is at https://www.extensionshop.store/extension/headerdesk.

## Data collected

| Data | Optional | Purpose |
| --- | --- | --- |
| Profiles and settings (stored locally) | No | Your profiles, header rows and settings, and up to 10 automatic backups of them. Header values are stored as you typed them, because they are the rules. Kept in Chrome's extension storage on your device and never sent anywhere. |
| Usage counts (stored locally) | No | When HeaderDesk was installed, how many successful changes it has seen, on how many days, and your answers to the optional support and rating cards. Numbers and times only, with no site names and no header data. They stay on your device. |
| Check-view request logs (memory only) | Yes | The headers of requests that match your active rules, captured only while the Check view is open, with sensitive values masked. Kept in that view's memory, never written to disk, and gone when you close it. |

## Never collected

- Header values and tokens you type — they stay on your device, and exports mask sensitive values unless you choose to include them
- Page contents — HeaderDesk has no content scripts
- Browsing history — HeaderDesk keeps no list of pages
- Your Google account, name, email or any personal identifiers — there is no account
- Analytics, telemetry or crash reports of any kind
- Data sent to any server — there is no HeaderDesk server, and the only request it makes is the test request you click

## Third-party sharing

None. HeaderDesk makes no network requests of its own and uses no analytics, SDKs or servers. The one exception is "Send test request", which sends one request to the address you typed, only when you click it. Two links open a normal browser tab only when you click them: the heart or tip button opens the developer's Ko-fi page, and the rating button opens HeaderDesk's Chrome Web Store page. HeaderDesk sends nothing to these sites. Exports are files you ask for, and are never uploaded.

## Encryption

No data is transmitted.

## Data retention

Profiles, settings, backups and usage counts stay in your browser's extension storage until you change them or remove the extension, which deletes them automatically, and Chrome removes HeaderDesk's header rules with it. Check-view logs are gone when you close the Check view. Allowed sites are kept by Chrome as the extension's site permissions; remove them in HeaderDesk or at chrome://extensions.

## Permissions

| Permission | Why it is needed |
| --- | --- |
| Modify headers (declarativeNetRequestWithHostAccess) | The core of the extension: applies your header rules through Chrome's declarativeNetRequest API, and only on the sites you allowed. It has no install warning of its own. |
| Site access, only for the sites you allow (optional) | Nothing is granted at install. When you scope a profile, Chrome asks for the sites it targets and the site that makes the requests (Chrome needs both for fetch and XHR), or for all sites if you choose "All sites". Every allowed site is listed in HeaderDesk with a remove button. |
| Active tab | Reads the address of the current tab after you click the toolbar button, so HeaderDesk can offer "this site" as the scope of a new profile. It gives no access to the page itself. |
| Read request headers (webRequest) | Observation only, for the Check view: shows the request and response headers Chrome actually sent and received for requests that match your rules. It listens only while the Check view is open, never blocks or changes a request, and adds no install warning. |
| Storage | Keeps your profiles, header rows, settings, up to 10 automatic backups and a few local usage counts on your device. |
| Side panel | Lets you open HeaderDesk in Chrome's side panel as well as the popup. |

Support: iliasselbarhoumi@gmail.com