VibeHeader — Privacy Policy

1) Scope

This Privacy Policy applies to the VibeHeader Chrome extension (“Extension”). It does not cover our marketing website — for that, see the Website analytics notice below.

2) Summary

• We do not collect, transmit, or sell personal data.
• No ads. No analytics. No third-party trackers.
• Profiles, headers, Request Filters, and preferences are stored locally in your browser and remain under your control.

3) Information we process

We do not operate any backend for the Extension and do not receive data from your device. The only information the Extension handles is:

• Profiles and header configurations you create or import (e.g., Profile names and key–value pairs such as Accept-Language, User-Agent, or custom X- headers).
• Request Filters you add to a Profile (e.g., domains, URLs, wildcard patterns, or regular expressions) and URLs you enter into the local filter tester.
• Minimal UI preferences (e.g., last settings state), stored locally.

VibeHeader does not upload those values to a VibeHeader backend. When a Profile is active, however, Chrome adds its headers to matching requests, so the destination website or API receives them as you configured. Use Request Filters to limit where sensitive values are sent, prefer short-lived credentials, and do not place secrets in links you may share broadly.

4) Share links (how they work)

• One Profile—including its name, enabled valid headers, and valid Request Filters—is encoded in the URL fragment (the part after #) and is parsed locally in the receiver’s browser.
• The fragment is not sent to our servers when the page loads.
• If you share a link with someone or via a third-party service (e.g., chat, email), those recipients/services will see the link. Links you publish publicly may be indexed or forwarded by others.

5) Storage & retention

• Configurations and preferences are saved in chrome.storage.local on your device.
• Data persists until you delete it (via the Extension’s reset option, removing the Extension, or clearing Chrome’s extension data).

6) Permissions we use (why)

A small content script runs only on pages at https://www.vibeheader.com/s* to parse share-link fragments and trigger the local preview/apply flow. We do not inject scripts into third-party sites.

7) No third-party sharing or selling

We do not share, sell, or rent data to third parties. We do not use data for advertising or for purposes unrelated to the Extension’s core functionality.

8) Security

VibeHeader follows a local-first design and documents why each requested permission is needed. All code runs from the packaged extension; we do not load or execute remote code (no external scripts, no dynamic imports, no remote Wasm). Still, no software is perfect—please contact us if you discover a security issue.

9) Your choices & control

• Edit or remove your configurations at any time inside the Extension.
• Reset or uninstall the Extension to delete local data.
• Revoke site access at any time using Chrome’s extension “Site access” controls.

10) Children’s privacy

The Extension is intended for professional/technical users and is not directed to children under 13. We do not knowingly collect information from children.

11) Changes to this Policy

If we introduce new features that require cloud services (e.g., optional sync or team features), we will update this Policy, request any additional permissions, and obtain your opt-in before enabling them. We may update this Policy from time to time; the “Effective date” indicates the latest version.

12) Contact

Questions or requests? Email hello@vibeheader.com.

Appendix: Website analytics notice

This notice covers our marketing website (www.vibeheader.com) only.

• The Extension contains no analytics or tracking whatsoever — see the policy above.
• The share page (/s) loads no analytics scripts at all, and your configuration in the URL fragment (#c=...) never reaches any server. A server-side, first-party counter records that the share page was requested and forwards the browser User-Agent to our self-hosted analytics; it does not receive the fragment or forward the visitor’s IP address.
• Other marketing pages use cookie-less analytics (Vercel Web Analytics and a self-hosted instance of the open-source Umami, running on infrastructure we control) to count page views and install-button clicks. No cookies, no cross-site tracking, no personal profiles.