Privacy Policy — Pixel CAPI Inspector

What the extension collects

Only during an explicitly started recording session (Start recording / Reload & record), and only for the tab and origins you granted:

• requests to advertising-platform endpoints and to your own collector (URL, method, timing, HTTP status, request body of pixel/collector calls);
• SDK calls made by the page (fbq, ttq, snaptr, rdt, pintrk, dataLayer.push);
• a fixed allowlist of tracking cookie names (_fbp, _fbc, _ttp, _scid, _rdt_uuid, _epik) on session origins.

What stays local

All capture, correlation, rules and reports are computed locally. While observing, the extension makes zero requests to any backend (enforced by an automated test). Closing the panel or pressing Stop clears raw buffers; session origins are revoked on Stop.

What leaves the browser

Observe, Trace and Report make no backend requests. After you explicitly enable the optional Send transport, the extension may request its public capabilities and a short-lived bootstrap nonce from https://pixel.way2.us. When you review and confirm a draft, the minimised draft (event name, event id, time, value/currency, optional match keys) is POSTed to the fixed /api/extension/send endpoint. A user-requested Check status POST may also include the token re-entered for that lookup. The backend forwards only a confirmed Send to the selected advertising platform; nothing is transmitted automatically.

Tokens

Platform tokens live only in the password input and the POST body of an explicit Send or user-requested status lookup. They are never stored (storage.* is not used for them), never logged, never included in reports, exports or error messages.

Data retention

• Evidence buffers are in-memory and cleared on Stop (a redacted report can stay in the open panel until it is closed).
• The local operation journal keeps metadata only — {operation id, created/updated/expiry timestamps, status/outcome, HTTP status} plus the labels needed to merge the outcome into the matrix ({session id, platform, event name, canonical event name, mode}) — no event payload, no destination credentials, no token — for 24 h so an outcome can be recovered after a restart. The metadata is written before the POST starts, so an interrupted send stays scoped to its capture session.
• The backend keeps a durable idempotency record (keyed hashes + redacted response) for 24 h to prevent duplicate sends. No tokens are stored there.

Telemetry

None. No analytics SDK, no remote config, no remote executable rules.

Contact

[email protected]

Incognito (private mode)

The extension runs in incognito in split mode. The send journal (sendOperations — operation id, statuses, timestamps) is stored in chrome.storage.local and is not isolated differently in a private context in the MVP: this is a documented limitation. Platform tokens are never stored — not in the journal, not in storage, not in reports. Full journal isolation via chrome.storage.session is planned after the MVP.