Privacy Policy

Last updated: 2026-07-20

Shadow Monitor is a Chrome extension for local diagnostic capture during user-acceptance testing (UAT). This policy describes what the extension collects, where it goes, and what you control.

It also serves as our Chrome Web Store Limited Use disclosure: we use captured data only to provide the extension’s single purpose (local UAT bug diagnosis and user-initiated export). We do not sell user data, do not use it for advertising, and do not transfer it to third parties — the developer never receives your capture buffer.

What we capture

When capture is active on a domain you have explicitly granted in Settings (after acknowledging the in-product disclosure), the extension may record:

• DOM and interactions — via rrweb. Typed input is recorded by default; passwords, payment fields, and elements tagged with .uat-mask / data-uat-mask stay masked.
• Network — URLs, methods, status codes, headers, and bodies for fetch, XMLHttpRequest, and navigator.sendBeacon (MAIN-world observation; not Chrome DevTools Protocol).
• Web storage — localStorage and sessionStorage snapshots.
• Cookies — non-HttpOnly cookies visible to page scripts (on by default; can turn off). HttpOnly cookies are not readable.
• Console and errors — by default console.error plus uncaught exceptions (configurable). Not via chrome.debugger.

Where data goes

Nowhere off your device. The extension makes zero network requests to our servers or any third party. No analytics, telemetry, remote configuration, or CDN assets at runtime.

Events are sanitized in the service worker, then stored in IndexedDB inside your Chrome profile. Exports are written only when you click download — as a gzip-compressed JSON file via Chrome’s downloads API.

If you later share an exported file (email, Slack, bug tracker), that sharing is your action, not extension telemetry.

How long we keep it

By default, a rolling 10-minute buffer (configurable up to 120 minutes). Older events are purged automatically. You can clear the buffer in Settings at any time.

Who can access it

Only you on this machine and browser profile. Optional encryption at rest uses a passphrase you choose; we cannot recover it if you forget it. Treat exported files as sensitive UAT artifacts.

What you control

• Grant or revoke per-origin access
• Buffer retention, export range, download folder
• Record inputs, capture cookies, console mode
• Optional buffer encryption and per-download share encryption
• Clear the rolling buffer at any time

Optional per-bundle encryption

When you opt in to encrypt a download for sharing, encryption runs locally with the Web Crypto API. The passphrase is shown once in the popup and is not stored by the extension.

Third parties

None for capture data. No subprocessors, no cloud storage, no crash reporting from the extension.

This public website may load webfonts from Google Fonts to render the page. That is separate from the extension, which does not load remote fonts or scripts.

Children’s privacy

Shadow Monitor is intended for adult testers and developers. It is not directed at children.

Changes

If data-handling practices change, we will update this policy and disclose material changes in the product as required by Chrome Web Store policy.

Security / privacy contact

Report issues via the support page (tymandzii@gmail.com).