API Sniffer is a developer tool that passively monitors HTTP traffic in your browser and saves detected API requests to a local library. It was built with a strict privacy-first approach: the extension has no backend, no telemetry, no ads, and no external dependencies beyond loading fonts from Google Fonts when displaying its interface.

When you browse the web, API Sniffer inspects outgoing HTTP requests and stores the following metadata locally in your browser via browser.storage.local:

• Request URL — the full URL of detected API calls
• HTTP method — GET, POST, PUT, DELETE, PATCH
• HTTP status code — the response status (200, 404, etc.)
• Request headers — with sensitive values (Authorization, API keys) automatically redacted and replaced with ***REDACTED***
• Response headers — content-type, cache-control, etc.
• Cookies — names and values from Cookie / Set-Cookie headers. Values are hidden by default in the UI and require an explicit click to reveal
• Source page — the title and URL of the tab that triggered the request
• Timestamp — when the request was detected

None of this data ever leaves your browser. It is not transmitted to any server, not synced across devices, and not accessible to any third party.

• Response bodies — the browser's webRequest API does not expose response content; only metadata is available
• POST request bodies — form data, JSON payloads, file uploads are not captured
• Browsing history — only requests matching API detection heuristics are stored
• Personal information — name, email, phone number, address
• Location data — no GPS or geolocation access
• Identity or account data — no login, no account, no profile

API Sniffer requests the following browser permissions, each strictly necessary for its functionality:

All data is stored in browser.storage.local, which is sandboxed to the extension and inaccessible to websites or other extensions. The stored data includes:

• Your captured API request library (up to 500 entries by default, configurable)
• Your extension settings (detection keywords, excluded domains, UI preferences)

You can clear all stored data at any time using the ✕ Clear button in the extension popup, or by uninstalling the extension.

API Sniffer's interface loads fonts from Google Fonts (fonts.googleapis.com) when the popup, fullscreen view, or settings page is opened. This is a standard CDN request and subject to Google's privacy policy. No other external service is contacted by the extension.

If you prefer to avoid this, fonts will fall back gracefully to your system monospace and sans-serif fonts — no functionality is affected.

If this privacy policy is updated, the new version will be published alongside the extension. Given that no data is collected, future changes would likely involve clarifications or the addition of new privacy-respecting features.

If you have any questions about this privacy policy or the extension's behaviour, feel free to reach out: