Skip to content

PRIVACY.md

Latest commit

 

History

History
69 lines (51 loc) · 2.61 KB

PRIVACY.md

File metadata and controls

69 lines (51 loc) · 2.61 KB
Raw

Privacy Policy — Native Federation DevTools

Last updated: 2026-08-31

Short version: the extension collects nothing. No data ever leaves your machine.

Native Federation DevTools is a read-only Chrome DevTools panel. It has a single purpose: showing how a Native Federation application resolved its shared dependencies — packages, remotes, the import map, and the resulting dependency graph.

What the extension reads

Only while DevTools is open on a page you inspect, and only when you open the Native Federation panel, the extension reads:

  • location.origin, location.pathname, and document.readyState of the inspected page
  • the Native Federation registry the runtime keeps in the page (window.__NATIVE_FEDERATION__)
  • the import maps present in the page's DOM
  • whether an importShim global is present

That is the complete list. The read is performed by one fixed expression that ships inside the extension bundle (passive-probe.ts); the inspected page never contributes executable text to it, and the probe performs descriptor-level reads only — it never calls page functions and never writes page state.

What the extension does not do

  • It declares no permissions and no host permissions, has no content scripts and no background page.
  • It makes no network requests of any kind: no analytics, no telemetry, no crash or error reporting, no update pings.
  • It loads and executes no remote code. Everything it runs is in the package you installed.
  • It does not read cookies, browser storage, form input, credentials, browsing history, or page content beyond the fields listed above.
  • It never modifies the inspected page.

Where the data goes

Nowhere. The snapshot lives in memory in the DevTools panel while the panel is open and is discarded when you close DevTools.

The Export JSON button writes that snapshot to a file you choose, on your own machine. The file is not uploaded anywhere; what you do with it afterwards is entirely up to you.

URLs in snapshots

Every URL is passed through a sanitizer (privacy.ts) before it can enter a snapshot: user info, query string, and fragment are stripped. Access tokens or session identifiers carried in query parameters therefore never reach the panel or an exported file.

Third parties

There are none. No data is shared, sold, or transferred to anyone, and nothing is used for advertising, profiling, or creditworthiness assessment.

Contact

Questions or concerns: please open an issue at https://github.com/native-federation/devtools/issues.