Privacy Policy

Blackbox API Visualizer ("Blackbox") is a Chrome DevTools extension for inspecting, analyzing, and visualizing network traffic from the web page currently being inspected. This policy explains what information Blackbox can access, how that information is used, and what controls are available to you.

Information Blackbox Can Process

When you grant network access and use Blackbox on an inspected page, the extension can process information exposed by Chrome DevTools, including:

• request URLs, hosts, paths, methods, and query parameters;
• request and response headers;
• cookies and authentication-related values that may appear in requests or responses;
• request bodies and submitted payloads;
• response status information, MIME types, redirects, and size metadata;
• network timing, resource type, cache information, initiator information, connection information, and server IP addresses;
• response bodies for captured requests that you select in the request inspector;
• a bounded set of recent successful Fetch/XHR response bodies when tracing whether a selected derived resource URL came from earlier API response data; and
• script/source resources and source maps exposed locally by DevTools when mapping generated bundle locations back to authored source files.

Depending on the website being inspected, this information may contain personal information, authentication tokens, session identifiers, application source code, or other sensitive content. Blackbox uses this information because inspecting the actual network exchange and its local source context is the core function of the extension.

How Blackbox Uses This Information

Blackbox uses captured network and source information only to provide its user-facing developer tools, including:

• the request list and request inspector;
• request and response metadata views;
• timing and performance information;
• request-level diagnostics and diagnostic context;
• source-file and function correlation when reliable local evidence is available;
• exact resource provenance relationships, such as a resource URL found in a previous API response;
• duplicate-request, polling, endpoint, domain, and error analysis;
• session insights;
• copied debug summaries that intentionally omit raw headers, cookies, authorization values, and request/response bodies; and
• the interactive network graph.

Blackbox does not use captured traffic or source content for advertising, behavioral profiling, marketing, eligibility decisions, or any purpose unrelated to its developer-tool functionality.

Source and Relationship Analysis

When you select certain derived resources such as images, media, scripts, stylesheets, fonts, manifests, or similar resources, Blackbox may inspect a bounded set of recent successful Fetch/XHR response bodies already available through DevTools. It looks for exact URL relationships between the selected resource and values returned by those API responses. Blackbox does not use fuzzy matching to claim these relationships.

When DevTools exposes generated scripts, authored source resources, or source maps, Blackbox may read them locally to map generated JavaScript locations back to original JavaScript, JSX, TypeScript, TSX, Vue, Svelte, Astro, or other source files. Blackbox only reports an authored extension or filename when that information exists in actual source/source-map evidence; it does not rename generated .js files to another language based on a framework guess.

For generated same-origin JavaScript files, Blackbox may also try the conventional sibling source-map location (for example, main.js.map) when that map was not already exposed by DevTools. That request goes only to the inspected site's own origin from the inspected page context. Cross-origin source-map files are not fetched by this fallback.

Blackbox does not use a Blackbox-operated service to retrieve source maps or source files. Source correlation is limited to content exposed by the inspected page, captured network resources, DevTools resources available in the local browser session, and the same-origin source-map fallback described above.

Data Transmission and Sharing

Blackbox does not transmit captured network traffic or inspected source content to Blackbox-operated servers. Blackbox does not sell captured network data and does not share captured network data or source content with advertisers, data brokers, or unrelated third parties. The extension analyzes the information locally in the DevTools extension context on your device. A same-origin source-map fallback request, when used, goes only to the website already being inspected.

Storage and Retention

Captured request, response, source-context, and session data is kept in memory for the active DevTools session so Blackbox can render the request table, details, insights, diagnostics, source relationships, and graph.

• Choosing Clear removes the current captured session from Blackbox.
• Navigating the inspected page resets the current captured session and source-context cache.
• Closing the DevTools panel ends the in-memory session.
• Response bodies are retrieved automatically when you select a captured request and are kept only in the active in-memory session.
• Additional recent Fetch/XHR bodies, source resources, or same-origin source maps inspected for provenance/source correlation are cached only in memory for the active DevTools session.

Blackbox stores a small local preference indicating whether you granted network-capture consent. This preference contains no captured network traffic or source content. You can remove it by choosing Privacy → Revoke access, clearing the extension's local data, or uninstalling the extension.

Your Choices and Controls

• Start capturing — grants access and begins network capture.
• Not now — leaves network capture disabled.
• Pause / Resume — temporarily stops or resumes capture after consent has been granted.
• Clear — removes the current captured session from the Blackbox interface.
• Privacy → Revoke access — disables future capture and clears the current Blackbox session.
• Selecting a captured request retrieves its response body automatically so the response view and local debugger can use it as context.
• Selecting a derived resource may trigger bounded local provenance/source analysis as described above.
• Source analysis may request a conventional same-origin .map file for a generated script when DevTools did not already expose it.

Security

Network traffic and source resources may contain credentials, tokens, cookies, personal data, application secrets, or proprietary source code. Treat information displayed in Blackbox as sensitive and avoid sharing screenshots or other material that exposes confidential values. Blackbox is designed to minimize exposure by processing captured traffic and source context locally rather than sending it to a Blackbox backend. The built-in debug-summary formatter also avoids copying raw headers, cookies, authorization values, and request/response bodies by default.

Children's Privacy

Blackbox is a developer tool and is not directed to children.

Changes to This Policy

This policy may be updated when Blackbox's data-handling behavior changes. Material changes will be reflected in this public policy and in the project repository.

Contact

Privacy questions or concerns can be raised through the Blackbox GitHub issue tracker.