Privacy Policy

QuickHeader is a browser extension that lets you add, edit, or remove HTTP request and response headers for web development and API testing. QuickHeader runs entirely inside your browser. It does not have a server, does not make network calls of its own, and does not collect, transmit, or sell any data — from you or about your browsing.

The profiles, header rules, recipes, and settings you configure are saved locally on your device using the browser's built-in chrome.storage.local and chrome.storage.session APIs. This data never leaves your browser — it is not synced to any server QuickHeader operates, and QuickHeader has no backend to send it to.

Header values you configure. Some header rules are naturally sensitive — for example, an Authorization header value or an API token you set up so QuickHeader can inject it into your own requests. That value is stored the same way as any other header rule: locally, on your device, and only used to apply the rule you created. QuickHeader never reads, transmits, or has any use for this value beyond applying it to the requests you've scoped it to.

Request log. The Log tab shows which of your header rules fired on real requests, so it locally records the URL, matched profile, and timestamp of requests your active rules apply to (this is also how "last triggered" is computed). This log stays in chrome.storage.local on your device, is never transmitted anywhere, and can be cleared or exported by you at any time from the Log tab.

If you use the extension's Import/Export feature, the exported JSON file is saved directly to your device by your browser's normal download mechanism. QuickHeader does not upload it anywhere.

• storage — saves your profiles, header rules, and settings locally so they persist between browser sessions.
• declarativeNetRequest — the mechanism used to add, remove, or modify HTTP headers on requests and responses you've configured a rule for.
• webRequest — used read-only, with no blocking or modification, to detect when a header rule actually applied to a real request, powering the "last triggered" indicator and request log. QuickHeader does not read request or response bodies, or cookies.
• alarms — periodically refreshes dynamic header values (such as {{timestamp}}) since the browser evaluates header rules statically rather than via a live per-request callback.
• activeTab — reads the URL of the tab you have open only when you interact with the extension, to power the "diff for current tab" view.
• host_permissions (all sites) — required so your header rules can apply to whichever site you're testing against. QuickHeader does not read, log, or transmit page content — only the header names and values you explicitly configure.

QuickHeader does not share, sell, or transmit any data to third parties, because it does not transmit data anywhere at all. There are no analytics SDKs, no crash reporters, and no remote code — everything QuickHeader runs ships inside the extension package itself.

QuickHeader is a developer tool and is not directed at children. It does not knowingly collect information from anyone, including children, because it does not collect information at all.

If this policy changes, the update will be posted on this page with a revised effective date. Since QuickHeader has no way to contact you directly, please check back here before updating to a new version if you have concerns.

Questions about this policy or QuickHeader can be sent to askillys@gmail.com.