Headerloom privacy policy
Effective 2026-10-18 · applies to the Headerloom Chrome extension, version 0.1.0 and later · publisher: Gilad Amar ("we")
1. Data the extension handles on your device
| Data | Where it is kept | How long |
|---|---|---|
| Your profiles: header names and values (which may include tokens you enter), response headers, redirects, the sites or URL pattern each profile applies to, on/off and pause state | chrome.storage.local; the active profile is also given to Chrome as declarativeNetRequest dynamic rules | Until you delete the profile or rule, or uninstall |
| Settings (theme) | chrome.storage.local | Until you change them or uninstall |
| License details if you activate Pro: the key, Lemon Squeezy activation ID, plan name, the purchase email and expiry returned by Lemon Squeezy, and the last check time | chrome.storage.local | Until you deactivate the license or uninstall |
| The current tab's address | Read in memory while the side panel is open (only for sites you granted access to), to show which site the rules apply to, add it with one click, and build the "Copy as cURL" command | Not stored |
| Import and export files | Import reads only the JSON file you select in the file picker. Export saves a JSON file to your Downloads folder | Under your control |
Header values are stored unencrypted in your browser's extension storage, like the settings of any extension. Prefer test credentials. None of this data is sent to us; we do not operate any server that receives it.
2. Data that leaves your device
Your own requests. The headers and redirects you configure are applied by Chrome to requests your browser makes to the sites you chose. That is the purpose of the extension: those sites receive the headers you set. Headerloom does not send them anywhere else.
License checks. If you enter a Pro license key, the extension sends HTTPS requests to https://api.lemonsqueezy.com/v1/licenses/: activate (your key and a random instance name), validate (your key and the activation ID, at most once every 7 days, triggered by a once-a-day background check) and deactivate (when you click Deactivate). Lemon Squeezy (Merchant of Record) receives your IP address as with any web request and processes this data under its privacy policy. If you never enter a key, Headerloom makes no network requests of its own.
Checkout happens on Lemon Squeezy's website, not in the extension.
3. Access to websites and other extensions
- Site access is an optional permission, requested for one site (and its subdomains) when you add it under "Applies to", or for all sites only if you choose "All sites" or a URL regex. Nothing is granted at install. You can remove access in Chrome's extension settings.
- Headerloom has no content scripts and does not read or change page content. It cannot read request or response bodies.
- Headerloom does not access, read or communicate with other extensions or their data. Importing from ModHeader works only from an export file you created and chose yourself.
- No remote code is loaded. All code ships inside the extension package.
4. Permissions and why we need them
| Permission | Used for |
|---|---|
storage | Keeping your profiles, settings and license status on your device |
sidePanel | Showing the Headerloom panel next to the page you're testing |
declarativeNetRequestWithHostAccess | Giving your header and redirect rules to Chrome, which applies them only on sites you granted access to |
alarms | The once-a-day check of whether a Pro license is due for its weekly re-validation, and re-applying rules if the plan changed |
clipboardWrite | Copying the cURL command when you click "Copy as cURL" |
Optional site access (<all_urls>, granted per site) | Applying rules on the sites you add |
Host access to api.lemonsqueezy.com | License activation, validation and deactivation (section 2) |
5. What we don't do
- No analytics, telemetry, advertising, cookies or fingerprinting in the extension.
- We don't sell or transfer user data to third parties, except the license check described above.
- We don't use or transfer user data for purposes unrelated to the extension's single purpose.
- We don't use or transfer user data to determine creditworthiness or for lending purposes.
The use of information received from Chrome APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. Your choices and rights
Delete profiles in Settings, deactivate your license, or uninstall Headerloom (Chrome removes its storage and rules). We hold no extension data on our servers. For purchase records held by Lemon Squeezy or any privacy question (including GDPR/UK GDPR requests), email busywright@mail.grokbot.com.
7. Children
Headerloom is a developer tool and is not directed at children under 16.
8. Changes
If a future version handles data differently, we will update this page and the effective date before releasing it.
9. Contact
Gilad Amar, Thailand · busywright@mail.grokbot.com
ModHeader is a trademark of its owner. Headerloom is not affiliated with or endorsed by ModHeader.