Privacy Policy

Api Surgery — Last updated: July 2026

This Privacy Policy describes how Api Surgery ("the Extension", "we", "our") collects, uses, stores, and protects information when you use our Chrome extension. We are committed to ensuring that your privacy is protected and that all data processing is transparent, minimal, and secure.

By installing and using the Extension, you agree to the practices described in this policy. If you do not agree, please uninstall the Extension.

1. Scope & Purpose

Api Surgery is a developer tool that intercepts and inspects HTTP API calls (fetch and XMLHttpRequest) made by web pages you visit. It displays the intercepted data in Chrome's side panel for debugging, performance analysis, and compliance checking. The Extension processes all data locally on your device and does not transmit intercepted data to any external server, cloud service, or third party.

2. Information We Collect

The Extension collects data exclusively from network requests on the currently active browser tab. All collection is performed locally. We distinguish between three categories:

2.1 Automatically Collected (from intercepted network requests)

Data Field	Description	Max Size
URL	Full request URL of each intercepted API call	1,000 chars
HTTP Method	GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS	—
Status Code	HTTP response status code	—
Duration	Request-to-response latency in milliseconds	—
Response Size	Size of the response body in bytes	—
Content Type	`Content-Type` header value from the response	—
Request Headers	All HTTP request headers set by the page's fetch/XHR call	—
Request Body	Payload sent with POST, PUT, PATCH requests (JSON, form data, text)	5,000 chars
Response Body	First portion of the response payload	5,000 chars
Initiator Type	fetch, xmlhttprequest, img, script, stylesheet, font, or other	—
Page URL	URL of the page where the API call was detected	—

2.2 Derived & Analyzed Data (generated locally)

The following data is derived algorithmically from the raw intercepted data. It never leaves your device in its raw form.

Derived Data	Source	Purpose
PII Detection Results	Response body scanned against regex patterns	Identify exposed emails, phone numbers, IPs, API keys, bearer tokens, passwords
JSON Response Schema	Parsed JSON response body	Infer field names, types, and nesting structure
GraphQL Analysis	Request/response body parsed for GraphQL	Extract operation type, field count, depth, complexity
OpenAPI Specification	Aggregated endpoints and methods	Generate machine-readable API documentation
TypeScript Type Definitions	JSON response schemas	Generate TypeScript interfaces for API responses
Lint Warnings	Evaluated against performance, security, and best-practice rules	Identify issues in API usage
API Quality Score	Aggregated lint deductions	Provide a 0–100 score summarising API health
Endpoint Shape History	Schema comparisons across sessions	Detect schema changes over time

2.3 Information You Provide

Payment status — verified via ExtensionPay's API (no payment details are collected, stored, or transmitted by the Extension itself).
None — the Extension does not ask for or collect any personal information such as your name, email address, or account credentials.

3. How Information Is Stored

All data is stored exclusively on your local device using Chrome's built-in storage APIs. No data is written to external databases, cloud storage, or remote servers.

Storage Mechanism	What Is Stored	Persistence
`chrome.storage.session`	Current tab's API call data (calls, endpoints, schemas)	Cleared when tab is closed or service worker terminates
`chrome.storage.local`	Session history, endpoint shapes, trial status, PRO status, settings	Persists until extension is uninstalled or storage is manually cleared
`chrome.storage.local` — sessions	Up to 50 most recent browsing sessions	Oldest sessions are automatically pruned when limit is exceeded

Manual deletion: All locally stored data can be removed by uninstalling the Extension, or by clearing site data via chrome://settings/content/siteData.

4. How Information Is Used

The Extension uses collected data solely for the following purposes:

Display in the side panel UI — so you can inspect, filter, and analyse API calls in real time.
Session history & evolution tracking — to compare API behaviour across page navigations and detect regressions.
Linting & scoring — to compute quality scores and highlight performance, security, and best-practice issues.
Type & spec generation — to produce TypeScript types and OpenAPI specs from live traffic.
Export — to generate HTML reports, HAR files, and cURL commands on demand.

The Extension does not use collected data for:

Advertising, marketing, or promotional purposes.
User profiling, behavioural analysis, or personalisation of content.
Artificial intelligence or machine learning training (whether internal or external).
Creditworthiness assessments, automated decision-making, or any purpose under applicable automated-decision laws.

5. Data Sharing & Disclosure

The Extension does not sell, rent, or share your personal data with any third party. The following table summarises every instance where data may leave your device:

Recipient	What Is Transmitted	Purpose	Legal Basis
ExtensionPay (extensionpay.com)	Payment initiation request (via browser redirect)	Process PRO tier purchase	Contractual necessity (performance of service)
ExtensionPay API (server-side verification)	Extension ID and payment token only	Verify payment status	Contractual necessity
Chrome Web Store	Extension ID, version, crash reports (if enabled by user)	Extension distribution and update delivery	Legitimate interest

No intercepted API data, no PII detection results, no browsing history, and no personal information is ever transmitted to any third-party server, cloud service, analytics platform, or data broker.

We may disclose information if required to do so by law, or in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights, or protect the safety of users.

6. Payment Processing & Monetisation

Api Surgery offers a PRO tier as a one-time paid upgrade (€5 EUR). Payment processing is handled entirely by ExtensionPay:

When you initiate a purchase, you are redirected to ExtensionPay's secure checkout page. The Extension itself never collects, stores, or transmits payment card numbers, billing addresses, or any financial account information.
The Extension queries ExtensionPay's API solely to verify whether the current user has an active payment record. No personal data is included in this verification request.
ExtensionPay's own Privacy Policy and Terms of Service apply to the payment transaction.
The free tier includes real-time API monitoring and evolution reports, with up to 5 tracked endpoints. Lint rules, PII scanning, shape tracking, GraphQL analysis, OpenAPI spec generation, timeline waterfall, and route discovery require PRO or the 24-hour full-access trial.

7. Security

We take the security of your data seriously. Because the Extension processes all data locally, the primary security considerations are:

Local processing: Intercepted API data never leaves your device and is not accessible to us, third parties, or any external infrastructure.
Chrome sandboxing: The Extension runs within Chrome's extension sandbox, which provides process isolation and restricts access to system resources.
Minimal permissions: The Extension requests only the permissions necessary for its core functionality (see Section 11). No unnecessary APIs are invoked.
Content Security Policy: The Extension enforces a strict CSP that prevents inline script execution and restricts resource loading to trusted origins.
No remote code: The Extension does not download or execute any remote code. All logic is bundled with the extension package.
Data truncation: Request and response bodies are truncated at 5,000 characters to limit the volume of data processed.

8. Data Retention & Deletion

Session data is retained in chrome.storage.session for the duration of the tab's lifetime. Data is automatically removed when the tab is closed or the service worker terminates.
Persistent data (session history, endpoint shapes, PRO/trial status) is stored in chrome.storage.local and remains until the extension is uninstalled or storage is manually cleared.
Automatic pruning: The session history is capped at 50 entries. When a new session is saved, the oldest session is automatically discarded.
Manual deletion: To delete all local data: (a) uninstall the Extension from chrome://extensions, or (b) clear site data via chrome://settings/content/siteData, or (c) right-click the Extension icon → Manage Extension → Clear Storage.
Server-side data: There is no server-side data to delete. The Extension maintains no backend infrastructure.

9. Data Categories & Data Flow Summary

Category	Collected?	Stored Locally?	Transmitted Off-Device?	Retained After Uninstall?
Request/Response metadata (URL, method, status, timing, size)	Yes	Yes	Never	No
Request/Response bodies (truncated)	Yes	Yes	Never	No
PII detection results	Yes	Yes	Never	No
JSON schemas / TypeScript types	Yes	Yes	Never	No
GraphQL query analysis	Yes	Yes	Never	No
OpenAPI specification	Yes	Yes	Never	No
Session history (aggregated)	Yes	Yes	Never	No
PRO/Payment status token	Yes	Yes	ExtensionPay only	No
Personal information (name, email, address)	No	—	—	—
Authentication credentials / passwords	No	—	—	—
Browsing history outside inspected API calls	No	—	—	—
Cookies or session tokens	No	—	—	—

10. Limited Use Requirements

Api Surgery's use and transfer of information received from Google APIs to any other app adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

Data obtained through Google APIs (if any) is used only for the single purpose described in this policy and the Extension's store listing.
Data is not transferred to any third party except as explicitly described in Section 5 of this policy.
Data is not used for advertising, AI/ML training, or any purpose unrelated to the core Extension functionality.
Data is not sold or used for creditworthiness determinations, lending, or insurance underwriting.

11. Permissions Justification

Each permission requested by the Extension is necessary for its core functionality. No permission is used for any purpose other than the one stated below.

Permission	Purpose	Alternative?
sidePanel	Display the Extension's UI in Chrome's side panel	Required by design — no alternative API exists
storage	Persist session history, endpoint shapes, trial/PRO status, and user settings locally	Required — without storage, data is lost on every navigation
scripting	Execute the interceptor script via `chrome.scripting.executeScript`	Required — MV3 mandates `scripting` over `tabs.executeScript`
host_permissions (<all_urls>)	Inject the interceptor into any website the user visits for debugging. The specific set of target sites cannot be known in advance	No viable alternative — `activeTab` alone is insufficient because intercepting must begin before the user opens the side panel

12. Children's Privacy

The Extension is a developer tool intended for use by software developers and technical professionals. It is not directed at children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect any personal information from children. If you believe that a child has provided personal information through the Extension, please contact us so that we can take appropriate steps.

13. International Users & Legal Compliance

13.1 General Data Protection Regulation (GDPR) — European Economic Area

For users in the European Economic Area (EEA), the following additional rights apply under the GDPR:

Right of access (Art. 15): All data processed by the Extension is visible in its UI and accessible via chrome.storage. You may request a structured copy by using the Export feature.
Right to rectification (Art. 16): The Extension does not store personal data that could be incorrect. If inaccuracies exist in displayed API data, they reflect the original server response.
Right to erasure (Art. 17): Uninstall the Extension or clear site data via Chrome settings. No server-side data exists to delete.
Right to restrict processing (Art. 18): You can disable the Extension at any time via chrome://extensions.
Right to data portability (Art. 20): Export your data in HTML, HAR, or cURL format using the Export button in the Extension UI.
Right to object (Art. 21): You may object to any processing by uninstalling the Extension. Since all processing is local and necessary for functionality, uninstallation is the appropriate remedy.
Automated decision-making: The Extension does not engage in automated decision-making or profiling that produces legal effects concerning you.

13.2 California Consumer Privacy Act (CCPA) — California, USA

For users in California, the following additional disclosures apply under the CCPA:

No sale of personal information: The Extension does not sell, rent, or share personal information for monetary or other valuable consideration.
No disclosure for business purposes: The Extension does not disclose personal information to third parties for business purposes, except as necessary for payment processing (Section 6).
Right to know: You may request information about the categories and specific pieces of personal information collected. All such information is accessible within the Extension UI.
Right to delete: You may request deletion of personal information by uninstalling the Extension or clearing Chrome site data.
Right to non-discrimination: The Extension will not discriminate against you for exercising any CCPA right.
No disclosure for cross-context behavioural advertising: The Extension does not engage in behavioural advertising.

13.3 Brazil Lei Geral de Proteção de Dados (LGPD)

For users in Brazil, the processing of personal data is governed by the LGPD. All data processing described in this policy is conducted locally on your device. You have the rights to confirmation of processing, access, correction, anonymisation, portability, and deletion of data, exercisable by uninstalling the Extension or clearing Chrome site data.

13.4 UK Data Protection Act

For users in the United Kingdom, the rights under the UK GDPR mirror those described in Section 13.1 above. The lawful basis for processing is your consent (by installing the Extension) and legitimate interest (providing the core debugging functionality).

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated via the Chrome Web Store listing or within the Extension's interface.

We encourage you to review this policy periodically. Your continued use of the Extension after changes take effect constitutes acceptance of the updated policy. If you do not agree with any modification, you should uninstall the Extension.

15. Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the Extension's data practices, please contact us through one of the following channels:

Chrome Web Store listing — use the "Support" link on the Api Surgery extension page.
GitHub Issues — open an issue on the project's support repository (link available in the Chrome Web Store listing).

If you are located in the EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority.