Effective date: August 1st, 2026
Contact: contact [at] headerforgeapp [dot] com
Summary
HeaderForge does not collect, transmit, sell, or share any user data. Everything you configure stays on your own computer, inside your Chrome profile. The extension has no server, no analytics, no telemetry, and no third-party services of any kind.
What HeaderForge stores
HeaderForge stores the configuration you create — profiles, header rules, cookie rules, URL filters, comments, and which profile is active — using Chrome's local extension storage (chrome.storage.local). This data:
- is stored only on your device, in the Chrome profile where the extension is installed;
- is never transmitted anywhere, by the extension or by anyone else;
- is not synced across devices by the extension;
- is readable only by you and the extension itself;
- is deleted when you remove the extension, or when you clear the extension's storage.
If you enter sensitive values into a rule — for example an authentication token or a session cookie — that value is stored in local extension storage in plain text, exactly like the rest of your configuration, and is sent only to the websites your own rules target. Anyone with access to your computer and Chrome profile can read it. If you use the extension's Export feature, the resulting file also contains those values; you control that file.
How HeaderForge uses its permissions
- Host permissions (all sites) — required so that the header rules you create can be applied to the websites you choose. HeaderForge does not read, log, or transmit the pages you visit or their contents. The permission is broad because you decide at runtime which URLs your rules target; the extension cannot know those URLs in advance.
declarativeNetRequest— applies your header and cookie rules at the network layer. Chrome performs the modification itself, based on rules the extension registers. The extension does not observe or receive the content of your requests or responses.storage— saves your configuration locally, as described above.cookies— used only to carry out the cookie "Set" and "Remove" rules you explicitly create, on the specific domains you specify. HeaderForge does not read, enumerate, collect, or transmit your cookies.scripting— used only when you click the "Verify" button. It runs a single request in the current tab and displays that page's response headers back to you inside the extension popup. The result is shown to you and is not stored or transmitted.
Data collection disclosure
HeaderForge collects none of the data categories defined by the Chrome Web Store program policies: no personally identifiable information, health information, financial or payment information, authentication information, personal communications, location, web history, user activity, or website content is collected or transmitted by the extension.
Remote code
HeaderForge executes no remote code. All logic ships inside the extension package and is reviewable in the published source.
Changes to this policy
Any material change to this policy will be published at this URL with an updated effective date, alongside the extension version that introduces the change.
Contact
Questions about this policy: contact [at] headerforgeapp [dot] com