Privacy
Headsmith · last updated 15 August 2026
Headsmith collects nothing and transmits nothing. It contains no analytics, no telemetry, no error reporting, and no network code of any kind. There is no server to send anything to, because there is no request the extension can make.
That is enforced rather than asserted: a check in the build pipeline scans the
packaged extension for network primitives — fetch,
XMLHttpRequest, WebSocket, sendBeacon,
EventSource, native messaging — and for any reference to an external
host in any file it ships. A release cannot be published if one appears.
It cannot see your browsing
Headsmith is built on Chrome's declarativeNetRequest API. Rules are
handed to the browser, which applies them itself; the extension is never invoked for
a request and receives no URL, header, body or response. It does not request the
webRequest permission, which is what an extension would need in order to
observe traffic.
What is stored, and where
| What | Where | Leaves your machine? |
|---|---|---|
| Profiles, header rules, scoping, settings | chrome.storage.local, on your computer |
No |
| Header values recognised as credentials | chrome.storage.session (cleared when Chrome closes), or AES-GCM encrypted in chrome.storage.local if you set a vault passphrase |
No |
| Vault key | Derived from your passphrase and held in chrome.storage.session only, dropped on lock |
No |
Chrome's cross-device sync is not used. There is no
chrome.storage.sync code path at all, so nothing is uploaded to a Google
account.
Site access
Headsmith requests no site access when installed. Access is requested for a specific domain when a profile names one, and only after you click to allow it. Everything granted is listed in the extension's Settings and can be withdrawn there, or from Chrome's own extension settings.
That access allows Headsmith's rules to modify headers on those sites. It
does not allow the extension to read anything, which
declarativeNetRequest does not permit in any case.
Removing your data
Uninstalling the extension removes everything it stored. There is no account, nothing held elsewhere, and nothing to request deletion of. You can also clear individual credentials, profiles or site permissions from within the extension at any time.
Children
Headsmith is a developer tool that collects no data from anyone, of any age.
Changes
If this ever changes, it will change in the public repository first, in a commit, alongside the code that changed. Permission changes additionally require an entry in SECURITY.md and cannot be merged without one.
Contact
Open an issue at github.com/bcollard/headsmith/issues, or report a vulnerability privately through the repository's Security tab.
← Back to Headsmith