The short version
- SpliceTap has no backend, no analytics SDK, and no telemetry.
- Nothing you create or capture ever leaves your device.
- There is no account, no sign-in, and no user identifier of any kind.
- Response bodies are stored only if you switch on Capture, and only for the browser session.
- The full source is public and auditable under the MIT License.
What SpliceTap stores, and where
Everything SpliceTap stores lives in chrome.storage on your own device — Chrome's
built-in extension storage, never a remote server.
| Data | Where | What it contains |
|---|---|---|
| Rules | storage.local |
The rules you create: names, URL patterns, methods, response bodies and headers, and
the internal rule id used to register header and query-param rules with
chrome.declarativeNetRequest. |
| Settings | storage.local |
Theme, debug mode, and chaos-mode configuration. |
| Stats | storage.local |
A running count of intercepted requests and the last-reset timestamp, for the popup's stats display. |
| Interception log | storage.session |
Metadata for the last 200 intercepted requests (URL, method, rule name and type, response status) so the DevTools panel keeps history across service-worker restarts. Clears automatically when the browser closes. |
Capture
One feature does record response bodies, and only when you ask it to. Capture, in the popup's Data tab, records real responses so you can build a rule from an actual payload instead of retyping it by hand. It is off until you switch it on.
While it is running the toolbar icon shows a REC badge, so it cannot be left on unnoticed. At most 25 responses are kept, each up to 100 KB, and only for textual content types such as JSON. They are held in session storage — the same place as the interception log — which means they are gone when the browser closes, and you can clear them yourself at any time from the same panel.
As with everything else here, captured responses stay on your device. There is nowhere for them to be sent.
What SpliceTap can see
To do its job, SpliceTap's content scripts run on every page you visit (the <all_urls>
host permission) and can observe fetch and XMLHttpRequest traffic on those
pages in order to match it against your rules.
This access is used only to apply your rules and to record the metadata described above. It is never transmitted anywhere. The permission is broad because there is no way to know in advance which site you will want to mock — the interceptor checks your rules internally before acting, and the rule editor overlay stays dormant until you invoke it.
Network requests
SpliceTap never initiates a request to any server operated by the developer, because no such server
exists. The only network activity the extension's own code performs is the pass-through
fetch() the interceptor makes on your behalf when a rule is in patch
mode — it fetches the real response from your API so it can modify a few
fields before handing it back to the page.
Rule import and export
Exporting writes a JSON file of your rules to your own downloads folder. Importing takes JSON you paste into the extension — there is no file picker, because a Chrome popup closes as soon as an operating-system dialog takes focus. Pasted JSON is validated and applied on your own device. Neither operation uploads anything.
Third parties
SpliceTap bundles no third-party libraries, SDKs, trackers, or fonts. It makes no calls to advertising networks, analytics providers, crash reporters, or content delivery networks.
No data is sold, rented, shared, or disclosed to anyone — there is no data collection to enable it.
Children's privacy
SpliceTap is a developer tool and is not directed at children. Since it collects no data at all, it collects no data from children.
Deleting your data
All SpliceTap data lives on your device, so you control it completely:
- Delete individual rules from the popup or the options page.
- Use Options → Advanced → Reset to clear all stored data at once.
- Uninstalling the extension removes everything Chrome has stored for it.
Changes to this policy
If this policy changes, the updated version will be published on this page with a new "last updated" date, and the change will appear in the project's public commit history.
Contact
Questions about privacy, or something here that looks wrong? Open an issue at github.com/Nataraaj-Shanmugam/SpliceTap/issues.