Your browser data stays in your browser.

• URLs and browsing activity: page and request URLs needed to display a redirect path, identify URLs from the current domain, reload tabs, and determine whether a configured rule applies.
• Request and response data: HTTP status information, request timing, and headers needed to present a trace or apply header rules.
• Authentication information: cookies accessible to the active site so you can view, create, edit, delete, encode, or decode cookie values.
• User configuration: profiles, request and response header rules, cookie overrides, redirect rules, URL conditions, request methods, enabled states, and preferences you create.
• Technical context: tab identifiers and navigation events required to associate activity with the correct browser tab.

• capture and display redirect and navigation paths;
• generate a cURL representation of a captured request;
• show and edit cookies for the active site;
• show and edit parameters for the current URL or other open URLs on the same domain;
• match and apply enabled profiles, headers, cookie overrides, and redirects; and
• save, import, export, and restore configuration when you request those actions.

TraceDeck does not use browser information for advertising, marketing, credit decisions, lending, insurance, surveillance, or any purpose unrelated to its single-purpose developer tooling.

Information stored locally

Your profiles, rules, and preferences are stored in chrome.storage.local. They remain on that browser profile until you modify or delete them, clear the extension’s local data, or uninstall TraceDeck.

Information kept temporarily

Redirect traces live in service-worker memory only. They disappear when you clear the trace, close its tab, or when the service worker or browser session ends, and TraceDeck never builds a persistent history of visited URLs. The URL Parameters view works the same way: it derives same-domain URLs from the current tab, other open tabs, and whatever trace data is already in memory, so there is nothing left to look up later.

Sensitive header values captured in a trace, such as an authorization token or session cookie, are masked by default in the popup's trace detail. Revealing one takes an explicit “Reveal sensitive headers” action in that view, and even then the value never leaves your device.

Website cookies

Cookies you create or modify are stored by your browser for the applicable website according to the cookie’s own attributes and that website’s behavior. They are not copied into a TraceDeck account or server.

Redirect-report exports redact sensitive header values such as authorization credentials, cookies, and recognized API-key headers. Before an import or restore replaces your current configuration, TraceDeck shows you what the file contains so you can decide whether to go ahead. Exported files are under your control from that point on, so review them before sharing and store them appropriately.

The extension does not load remotely hosted executable code. Its code and assets ship with the installed extension.

The popup includes an optional Buy me a Coffee link. TraceDeck contacts no support or payment service automatically. If you choose that link, your browser opens https://buymeacoffee.com/sutrakara in a new tab with referrer information suppressed. Your visit and any transaction are then governed by Buy Me a Coffee’s own terms and privacy practices. TraceDeck never sends that service your browsing activity, cookies, headers, profiles, rules, or preferences.

Privacy laws in some jurisdictions give you rights to access, correct, delete, or restrict personal information held by a service provider. Because TraceDeck does not receive or maintain your browser data on its own systems, there is generally no server-side user record for us to retrieve or delete. For help understanding the extension’s local data, contact us below.