Privacy policy

Last updated: November 5, 2026. Applies to the devkit Chrome extension.

The short version

devkit collects nothing. There is no devkit server, no account, no analytics and no telemetry. Everything devkit stores stays in your browser, and it only sends data off your device when you use a feature that needs to, to the destination that feature names.

What stays on your device

• Your settings, request rules, environment groups and the last tool you opened, in Chrome's extension storage.
• Your AI provider key, encrypted with a key kept in the extension's IndexedDB. It is never written to sync storage and never sent anywhere except to the provider it belongs to.
• Console errors captured from a page, kept in that page's memory and gone when it reloads or closes.
• Steps recorded for a bug report, only after you start the recorder: kept in Chrome's session storage for that tab, gone when the tab closes or the browser quits. Typed values are masked unless you turn them on; passwords, card numbers and hidden fields are never recorded.

What leaves your device, and when

• AI features. When you run an analysis or send a chat message, devkit sends the page data you chose (text, metadata, headers, structured data, errors, selection or screenshot) and your message to the AI provider you configured, with your own key, or to the local server you set (Ollama, LM Studio, Jan). That provider's privacy policy applies to what it receives. Nothing is sent until you ask.
• Model catalog. To list models and prices, devkit downloads public catalogs from models.dev and openrouter.ai. These requests carry no personal data.
• Page checks. The headers, link checker, robots.txt, sitemap and manifest tools request the current site's own URLs, from your browser, as any visit would.
• External tools. "Open in external tools" opens a third-party site (PageSpeed Insights, Rich Results Test and others) with the current page's URL, only when you click it.

What devkit does not do

• It does not sell or share data, and does not use it for advertising, credit or any purpose other than the feature you are using.
• It does not track your browsing. Site access is asked for when a tool needs it, and you can revoke it from the options page.
• It does not load or run remote code.

Permissions

The permissions table on the home page explains why devkit asks for each permission, and when.

Contact

Questions or concerns: open an issue on GitHub.