DevHeader

DevHeader Privacy Policy

Last updated: 2026-09-22

Summary

DevHeader is a local Chrome extension for developers. It modifies HTTP request and response headers, redirects request URLs, and mocks API responses (fetch/XHR) on domains you choose. DevHeader does not sell user data, does not use analytics, and does not transmit stored configuration to any external server.

Data DevHeader Stores

DevHeader stores only the data needed to provide its feature set:

  • Domain patterns you configure for header, redirect, and mock scoping
  • Header rule names and values you create
  • Redirect rules (match pattern and replacement URL)
  • Mock rules, including the request match (URL or GraphQL operation name) and the simulated response status, body, and headers you define
  • Named profiles (e.g. dev, staging, prod) grouping the above
  • Per-rule and per-profile enabled/disabled state

This data is stored locally in Chrome extension storage on your machine.

Data DevHeader Does Not Collect

DevHeader does not collect or transmit:

  • Browsing history for analytics or profiling
  • Personal account data
  • Payment data
  • Authentication credentials
  • Stored header, redirect, or mock rules to a remote service

How Data Is Used

The stored configuration is used only to:

  • Show your saved domains, header rules, redirect rules, and mock rules in the popup and DevTools panel
  • Apply request/response header modifications, URL redirects, and mocked responses to the domains you configure
  • Preserve your settings and profiles between browser sessions

Permissions

DevHeader requests only the permissions needed to work:

  • storage to save your local configuration
  • unlimitedStorage to remove Chrome's default 10MB chrome.storage.local size cap (profiles with many rules, or mock rules with large simulated response bodies, can exceed it) — this does not change what data is collected or where it's stored, only how much of it can be stored locally
  • declarativeNetRequest to apply configured request/response header rules and redirects
  • permissions and optional host permissions to request access to user-selected domains at runtime
  • scripting and userScripts (Chrome 138+) to inject the Mock Rules interception script into a page you've approved. This script patches fetch()/XHR so a matching request returns the synthetic response you defined, instead of hitting the real backend. userScripts is used alongside scripting because it runs reliably at document_start, which scripting alone can miss on a page's earliest requests; it requires you to separately enable "Allow User Scripts" for DevHeader in chrome://extensions, and is off by default. The injected script is built only from DevHeader's own bundled code plus your own locally-stored rules — nothing is fetched remotely or eval()'d — and it only registers for domains you've granted host permission to. If you never create a Mock Rule, nothing is injected.

Host access is requested only when needed for the domains you choose.

Data Sharing

DevHeader does not share your stored configuration with third parties.

Remote Code

DevHeader does not load or execute remote code. All logic, including the Mock Rules interception script, ships as part of the extension package.

Security

DevHeader is designed to keep configuration data local to the browser extension storage available on your device. As with any browser extension, you should review permissions before installing and use only builds from sources you trust.

Changes To This Policy

If DevHeader's data practices change, this privacy policy should be updated before the corresponding release is published.

Contact

If you publish DevHeader with a dedicated support or product email, replace this section with that public contact address.