Skip to main content Skip to navigation Skip to footer
Token Grab

Privacy Policy

Effective date: 30 July 2026

Token Grab (“the extension”) is a developer tool that captures configured HTTP request headers (such as Authorization) from websites you visit and lets you copy the value from its popup. This policy explains exactly what the extension does and does not do with your data.

Summary

  • The extension reads only the request headers you configure (default: common token headers such as Authorization).
  • Captured values are stored only in your browser’s local extension storage, on your device.
  • No data is ever transmitted to the developer or any third party. The extension makes no network requests of its own.
  • There is no analytics, no tracking, no accounts, and no advertising.

What data is processed

When enabled, the extension observes outgoing requests in your browser and, for the header names you have configured, records:

  • the header name and its value (the token),
  • the origin (scheme + host) and request URL the header was sent to,
  • a local timestamp of when it was seen.

This information is stored locally so you can copy it later. Header values are capped in size and the number of retained origins is bounded.

Where data is stored

All captured data and your settings are kept in the browser’s storage.local area, which resides on your device and is managed by your browser. The developer has no access to it.

What the extension does NOT do

  • It does not send captured tokens, browsing data, or any other information anywhere.
  • It does not modify, block, or redirect your web requests (it observes request headers read-only).
  • It does not collect personal information, sell data, or share data with third parties.

Your controls

You remain in control of the data at all times:

  • Choose what is captured — enable or disable token types and add or remove custom header names on the Settings page.
  • Mask values — token values are hidden in the popup by default.
  • Auto-expiry — optionally have captures automatically forgotten after a set period (1 hour, 24 hours, or 7 days).
  • Clear — remove all captured tokens at any time from the popup or Settings.
  • Uninstall — removing the extension deletes all of its stored data.

Permissions

The extension requests the minimum permissions needed to function:

  • webRequest and host access (<all_urls>) — to read the configured request header(s) on the sites you visit. Broad host access is required because a token can originate from any domain.
  • storage — to store captured tokens and your settings locally.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new effective date.

Contact

Questions? Contact hello@bingkil.com or open an issue at github.com/bingkil/token-grab.