DevHeader

DevHeader Privacy Policy

Last updated: 2026-11-03

Summary

DevHeader is a local Chrome extension for developers. It modifies HTTP request and response headers, redirects request URLs, and mocks API responses (fetch/XHR) on domains you choose. DevHeader does not sell user data, does not use analytics, and does not transmit stored configuration to any external server.

Data DevHeader Stores

DevHeader stores only the data needed to provide its feature set:

  • Domain patterns you configure for header, redirect, and mock scoping
  • Header rule names and values you create
  • Redirect rules (match pattern and replacement URL)
  • Mock rules, including the request match (URL or GraphQL operation name) and the simulated response status, body, and headers you define
  • Named profiles (e.g. dev, staging, prod) grouping the above
  • Per-rule and per-profile enabled/disabled state
  • A few counters used only to time an occasional review invitation: the date DevHeader was first opened, how many separate days it has been used, and whether the invitation was shown, dismissed, or clicked. These are kept apart from your profiles and are never sent anywhere.

This data is stored locally in Chrome extension storage on your machine.

Data DevHeader Does Not Collect

DevHeader does not collect or transmit:

  • Browsing history for analytics or profiling
  • Personal account data
  • Payment data
  • Authentication credentials
  • Stored header, redirect, or mock rules to a remote service

How Data Is Used

The stored configuration is used only to:

  • Show your saved domains, header rules, redirect rules, and mock rules in the popup and DevTools panel
  • Apply request/response header modifications, URL redirects, and mocked responses to the domains you configure
  • Preserve your settings and profiles between browser sessions

Permissions

DevHeader requests only the permissions needed to work:

  • storage to save your local configuration
  • unlimitedStorage to remove Chrome's default 10MB chrome.storage.local size cap (profiles with many rules, or mock rules with large simulated response bodies, can exceed it) — this does not change what data is collected or where it's stored, only how much of it can be stored locally
  • declarativeNetRequest to apply configured request/response header rules and redirects
  • permissions and optional host permissions to request access to user-selected domains at runtime
  • scripting and userScripts (Chrome 138+) to inject the Mock Rules interception script into a page you've approved. This script patches fetch()/XHR so a matching request returns the synthetic response you defined, instead of hitting the real backend. userScripts is used alongside scripting because it runs reliably at document_start, which scripting alone can miss on a page's earliest requests; it requires you to separately enable "Allow User Scripts" for DevHeader in chrome://extensions, and is off by default. The injected script is built only from DevHeader's own bundled code plus your own locally-stored rules — nothing is fetched remotely or eval()'d — and it only registers for domains you've granted host permission to. If you never create a Mock Rule, nothing is injected.

Host access is requested only when needed for the domains you choose.

Data Sharing

DevHeader does not share your stored configuration with third parties.

Feedback and Reviews

The popup's Feedback link opens the devheader.com contact form. If saving fails, a "Report this issue" button opens the same form prefilled with the extension version and a short error code (never your rules, domains, or header values). Nothing is sent unless you fill in and submit the form.

The popup may occasionally invite you to leave a store review. "Leave a review" opens the Chrome Web Store or Microsoft Edge Add-ons listing; DevHeader doesn't know whether you post a review.

Uninstall Survey

When you uninstall DevHeader, Chrome opens a short survey page on devheader.com. The page address includes only the extension's version number, nothing about your rules, domains, or browsing. Answering is optional, and the survey sends only what you choose to type into it.

Website Analytics

This section covers the devheader.com website only, not the extension. The website uses Cloudflare Web Analytics to count page visits. It does not use cookies, does not track individual visitors across sites, and does not collect personal data. The extension itself sends no analytics.

Remote Code

DevHeader does not load or execute remote code. All logic, including the Mock Rules interception script, ships as part of the extension package.

Security

DevHeader is designed to keep configuration data local to the browser extension storage available on your device. As with any browser extension, you should review permissions before installing and use only builds from sources you trust.

Changes To This Policy

If DevHeader's data practices change, this privacy policy should be updated before the corresponding release is published.

Contact

If you publish DevHeader with a dedicated support or product email, replace this section with that public contact address.