The short version
- SpliceTap has no backend, no analytics SDK, and no telemetry.
- Nothing you create or capture ever leaves your device.
- There is no account, no sign-in, and no user identifier of any kind.
- Response and request bodies are never stored.
- The full source is public and auditable under the MIT License.
What SpliceTap stores, and where
Everything SpliceTap stores lives in chrome.storage on your own device — Chrome's
built-in extension storage, never a remote server.
| Data | Where | What it contains |
|---|---|---|
| Rules | storage.local |
The rules you create: names, URL patterns, methods, response bodies and headers, and
the internal rule id used to register header and query-param rules with
chrome.declarativeNetRequest. |
| Settings | storage.local |
Theme, debug mode, and chaos-mode configuration. |
| Stats | storage.local |
A running count of intercepted requests and the last-reset timestamp, for the popup's stats display. |
| Interception log | storage.session |
Metadata for the last 200 intercepted requests (URL, method, rule name and type, response status) so the DevTools panel keeps history across service-worker restarts. Clears automatically when the browser closes. |
What SpliceTap can see
To do its job, SpliceTap's content scripts run on every page you visit (the <all_urls>
host permission) and can observe fetch and XMLHttpRequest traffic on those
pages in order to match it against your rules.
This access is used only to apply your rules and to record the metadata described above. It is never transmitted anywhere. The permission is broad because there is no way to know in advance which site you will want to mock — the interceptor checks your rules internally before acting, and the rule editor overlay stays dormant until you invoke it.
Network requests
SpliceTap never initiates a request to any server operated by the developer, because no such server
exists. The only network activity the extension's own code performs is the pass-through
fetch() the interceptor makes on your behalf when a rule is in patch
mode — it fetches the real response from your API so it can modify a few
fields before handing it back to the page.
Rule import and export
Exporting writes a JSON file to your own downloads folder. Importing reads a file you choose from your own disk, validates it, and applies it locally. Neither operation uploads anything.
Third parties
SpliceTap bundles no third-party libraries, SDKs, trackers, or fonts. It makes no calls to advertising networks, analytics providers, crash reporters, or content delivery networks.
No data is sold, rented, shared, or disclosed to anyone — there is no data collection to enable it.
Children's privacy
SpliceTap is a developer tool and is not directed at children. Since it collects no data at all, it collects no data from children.
Deleting your data
All SpliceTap data lives on your device, so you control it completely:
- Delete individual rules from the popup or the options page.
- Use Options → Advanced → Reset to clear all stored data at once.
- Uninstalling the extension removes everything Chrome has stored for it.
Changes to this policy
If this policy changes, the updated version will be published on this page with a new "last updated" date, and the change will appear in the project's public commit history.
Contact
Questions about privacy, or something here that looks wrong? Open an issue at github.com/Nataraaj-Shanmugam/SpliceTap/issues.