Effective July 11, 2026
Privacy Policy
This policy describes how WebForge Toolkit handles information when users operate the Chrome extension and visit this project website.
Overview
WebForge Toolkit is designed as a local browser development and QA workspace. It has no WebForge-operated backend, analytics service, advertising platform, or third-party tracking SDK. Most formatter, converter, analysis, and generation features process data inside Chrome.
Data handled by the extension
Depending on the page being visited and the feature the user enables or runs, WebForge Toolkit may handle:
- Browsing and network activity, including webpage and resource URLs, request methods, request headers and bodies when available, status codes, response headers, timing, transfer size, generated cURL, errors, and available page-level Fetch/XHR response bodies.
- Website content and resources, including titles, headings, visible text, links, image URLs, table data, forms, performance entries, accessibility signals, browser-observable security findings, and main-page security headers.
- Cookie names, values, domains, paths, expiry, Secure, HttpOnly, and SameSite attributes, plus localStorage and sessionStorage values, when the user runs Browser Storage analysis.
- HAR files, JSON, XML, CSV, TSV, JWTs, URLs, regular expressions, code, timestamps, and text explicitly opened or pasted into a tool.
- API and client configuration entered by the user, including endpoint URLs, request headers and bodies, usernames, passwords, bearer tokens, API keys, OAuth values, MQTT settings, Elasticsearch settings, and WebSocket, STOMP, or SSE settings.
- Extension settings, theme preference, mock rules, saved requests and profiles, and recent request logs.
This information may contain personal or sensitive data if it is present in the visited page, browser storage, network traffic, pasted input, uploaded file, or client configuration. Users should avoid using production secrets or personal data unless necessary for an authorized workflow.
Automatic page instrumentation and network observation
To provide page-level Network Inspector response capture and configured request-mocking features, WebForge Toolkit installs a packaged content script on supported webpages at document start. That content script injects packaged code that instruments the page's Fetch and XMLHttpRequest APIs. The instrumentation can observe request URLs, methods, headers and bodies when available, status, timing, errors, and readable response bodies. It does not download or execute remote code.
Observed page-level records are retained by the extension only when Network Inspector monitoring is enabled or when a request matches an enabled mock rule. Separately, the extension's background service worker observes request lifecycle metadata when monitoring is enabled and temporarily keeps the latest main-page response headers in service-worker memory so a user can run security-header and passive OWASP checks. The extension does not use webRequest to block, redirect, or modify traffic.
How information is used
Information is used only to provide or improve the extension's disclosed developer and QA features. Examples include applying a user-configured mock rule, displaying network details, formatting pasted JSON, producing a page export, checking observable page signals, generating a local report, or sending a request to an endpoint entered by the user.
WebForge Toolkit does not use browsing or page information for advertising, profiling, credit decisions, unrelated analytics, tracking users across services, or sale to data brokers.
Local storage, retention, and deletion
- Extension preferences, rules, saved profiles, and saved requests remain in Chrome extension storage until the user deletes them or uninstalls the extension.
- Saved client profiles or requests can contain credentials such as usernames, passwords, bearer tokens, and API keys. These values are stored in the user's Chrome extension profile and are not separately encrypted by WebForge Toolkit.
- Network Inspector retains up to 100 recent records and provides a Clear action. Captured records may contain URLs, headers, request bodies, response content, and generated cURL.
- The latest main-page security-header snapshot is held temporarily in service-worker memory and is not intentionally persisted as a saved report.
- Saved profiles and requests can be deleted from Client Utilities. Users should remove credentials and delete profiles when they are no longer needed.
- Formatter, converter, crypto, diff, timestamp, and HAR inputs are not uploaded to WebForge and are not intentionally persisted by those tools.
- Uninstalling the extension removes its Chrome local storage. Users may also clear records through the extension before uninstalling.
For assistance with local-data deletion, contact either contributor listed below.
Chrome permissions
| Permission | Purpose |
|---|---|
storage | Stores extension state, theme, rules, saved requests and profiles, optional client credentials, and up to 100 recent request records. |
tabs and activeTab | Identifies the active or original source tab for inspection, export, analysis, and full-view workflows and opens user-requested Help or OAuth pages. |
scripting | Runs packaged page capture, image extraction, quality, storage, table, link, and passive OWASP analysis functions in the selected page. |
webRequest | Observes request lifecycle metadata for Network Inspector and main-page response headers for security analysis. It is not used to block, redirect, or modify traffic. |
cookies | Reads cookie values and security attributes only when the user runs Browser Storage analysis for the selected page. |
Host access, including <all_urls>, ws://*/*, and wss://*/* | Allows page instrumentation, request observation, page tools, link checks, and user-configured HTTP, HTTPS, WebSocket, STOMP, MQTT-over-WebSocket, and other browser-compatible client workflows to operate on destinations selected by the user. |
Security practices
- No remote JavaScript or dynamically downloaded executable code is used.
- Users should prefer HTTPS and WSS endpoints with trusted certificates. HTTP and WS connections are not encrypted; they should be used only for trusted local or development environments without sensitive data.
- Users should use temporary, least-privilege development credentials and delete saved profiles when no longer needed.
- Request collection exports redact recognized authorization fields, but users should review all exports for URLs, headers, bodies, cookies, tokens, or other sensitive values before sharing.
Chrome Web Store Limited Use
WebForge Toolkit's use and transfer of information obtained through Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
- Information is used only to provide or improve the extension's disclosed, user-facing development and QA features.
- Information is transferred only when necessary to complete a connection or request explicitly directed to a destination selected by the user, or when otherwise required by applicable law.
- Information is not used or transferred for personalized advertising, retargeting, interest-based advertising, credit decisions, or sale to data brokers.
- The contributors do not permit humans to read locally handled user data. A user may voluntarily provide specifically selected, sanitized information when requesting support.
Contact
For privacy questions, support requests, or local-data concerns, contact either contributor: