Privacy Policy — QA Toolkit

Overview

QA Toolkit is a browser-based developer and QA tool. All features run entirely within your browser — no data ever leaves your device.

Visual inspection — CSS Inspector, Pixel Ruler, Color Picker, and iFrame overlay inject UI overlays into the active page. They do not read or transmit page content.

Network inspection — the Redirect Checker observes navigation requests for the active tab (URLs, HTTP status codes, and response headers) in memory to display the full redirect chain, including server-side (HTTP 3xx) redirects and client-side redirects triggered by a page itself (meta-refresh tags or JavaScript navigation). This is done by reading navigation timing/transition information Chrome already exposes for the active tab — no page content is read or transmitted. The Mock Server can intercept fetch and XMLHttpRequest calls, return configured mock responses, and optionally log real network requests temporarily in memory while the popup is open. This log is never stored persistently and is never transmitted.

Header modification — the User Agent Switcher overrides the User-Agent request header for the current tab only, using a session rule that is automatically removed when Chrome closes.

Content inspection — the OG Inspector and JSON Formatter read the active tab's content to display or format it. No data is transmitted externally.

Accessibility auditing — the Accessibility Checker runs axe-core (a vendored, open-source accessibility engine bundled directly inside the extension — see Third Parties) against the active page's DOM to find WCAG issues, approximate an accessibility tree, and test keyboard focus behavior. Everything — the scan itself, audit history, and any ignore rules you set — runs and stays entirely in your browser; opening its full dashboard in Chrome's side panel does not send anything anywhere. Exported reports (JSON/CSV/HTML) are generated and saved to your device locally; nothing is uploaded.

Storage inspection — the Storage Inspector reads and lets you edit localStorage, sessionStorage, and cookies for the active tab, entirely on request. Web storage is read/written directly in the page's own context; cookies are read/written through Chrome's cookies API, which can also see and edit HttpOnly cookies (something page JavaScript cannot do) so you can test cookie-based flows fully. Values are shown only in the popup while it's open and are never written to chrome.storage or transmitted anywhere — every add, edit, and delete is a change you explicitly make to your own browser's storage for that site, exactly as if you'd edited it in Chrome DevTools.

Encoding and decoding — the Decoder converts URL encoding, HTML entities, Base64, Unicode escapes, JSON, and JWT tokens, entirely with built-in browser APIs (no external decoding service of any kind). A JWT is only ever decoded for display — its signature is never verified, generated, or modified. Its optional "Pick element" button reads a single value (an input's value, a link's href, or a similar attribute) from an element you click on the page, only when you start that action; the value stays in the popup's memory and is never transmitted anywhere.

Image generation — the Lorem img tool generates placeholder test images entirely within your browser using the Canvas API. All rendering is local; no image data is sent to any server. Generated images are either downloaded to your device or copied to the clipboard — both actions are user-initiated and local-only.

No personal information is collected, transmitted, or shared with any external party under any circumstances.

Data We Do Not Collect

The extension does not collect, store externally, transmit, or sell any of the following:

Browsing history or page content
Form inputs, passwords, or credentials
Cookies or session tokens
Personally identifiable information
Location data or device identifiers
Usage analytics or telemetry of any kind

This means the extension itself — as opposed to Chrome's own storage for the site you're viewing — never collects, stores, or transmits these. The one deliberate exception is the Storage Inspector: at your request, it reads localStorage/sessionStorage/cookie values from the active tab so you can view and edit them in the popup, exactly as Chrome DevTools would. Those values stay in the popup's memory and in the site's own browser storage — the extension does not copy them anywhere else.

Local Storage

The extension uses the Chrome storage.sync and storage.local APIs to save your preferences on your device. This includes:

Enabled/disabled state and display order for each plugin
Selected interface language
JSON Formatter theme selection and active state
Mock Server rules you have configured and the last Response Body textarea height
Color Picker history
User Agent overrides
Lorem Ipsum preferences (text type, character count, paragraph count)
Lorem img preferences (image size, background style, colors, label, format, quality, EXIF orientation)
Last selected country and last generated synthetic record in the User Data Generator (randomly generated test data — not real personal information)
Accessibility Checker audit history (up to the last 50 audits, stored locally, with long HTML snippets truncated to stay within Chrome's storage quota)
Accessibility Checker ignore rules (issues or elements you've chosen to hide from future audits)

Preferences stored in storage.sync may be synced across your own devices by Chrome if you have Chrome Sync enabled. This sync is handled entirely by Google's Chrome infrastructure — the extension itself does not transmit any data.

The User Data Generator produces entirely synthetic, randomly generated test data (names, addresses, phone numbers, emails). It does not collect, read, or store any real personal information from you or from visited pages.

The Mock Server network log (URLs, HTTP methods, status codes, and response bodies) is held only in the popup's JavaScript memory while the popup is open. It is not written to chrome.storage and is discarded when the popup closes.

You can clear all stored preferences at any time via the Reset All Settings button in the extension's Settings page, or by removing the extension from Chrome.

Permissions Explained

Each permission exists for a specific, minimal purpose:

activeTab

Grants temporary access to the current tab when you interact with the extension. Used to apply visual tools to the active page.

scripting

Allows injecting CSS/JS overlays into pages. No injected code reads or exfiltrates page content.

storage

Used exclusively to save your local preferences. All data stays on your device.

webRequest

Used by the Redirect Checker to observe main-frame navigation in real time, recording each hop's URL and status code in memory. No data is transmitted externally.

webNavigation

Used by the Redirect Checker to detect when a page's own meta-refresh tag or JavaScript triggers the next navigation, so that hop can be linked into the same redirect chain instead of being shown as unrelated. No page content is read; only navigation metadata (URL and transition type) is used, in memory only.

declarativeNetRequest

Enables rule-based modification of page resources. All rules are applied locally and defined by you.

Used by the Storage Inspector to read and edit cookies (including HttpOnly ones) for the active tab, at your request. Cookie data stays in the popup and Chrome's own cookie store — it is never sent anywhere.

tabs + <all_urls>

Required to detect the active tab, inject content scripts, and apply tools across all sites. Tab URLs are processed in memory only — never stored persistently or transmitted.

sidePanel

Lets the Accessibility Checker open its full audit dashboard in Chrome's side panel. Only opens when you explicitly launch it from the extension popup.

Third Parties

This extension does not integrate with any third-party analytics, advertising, or data-processing services. No data is shared with or sold to any third party under any circumstances.

The Accessibility Checker bundles axe-core, an open-source accessibility testing engine (MPL-2.0 license) by Deque Systems, directly inside the extension package. It runs entirely inside your browser against the active page's DOM — it does not load anything from a remote server or send any data to Deque Systems or anyone else. This is a bundled library, not a third-party service.

Children's Privacy

This extension does not knowingly collect any data from anyone, including children under 13. Because no data is collected at all, COPPA obligations do not apply in practice.

Changes to This Policy

If the extension is updated in a way that changes data handling practices, this policy will be updated accordingly and a new effective date will be set. Continued use of the extension after such changes constitutes acceptance of the revised policy.

Contact

Questions about this privacy policy or the extension's data practices? Reach out at qa.toolkit.extension@gmail.com