Mockadabra Privacy Policy

In short

Mockadabra is a local-first developer tool. Everything it stores stays in your own browser profile. The extension has no account, no server, no analytics, no advertising and no telemetry, and the extension itself sends no data to the publisher or to any third party.

It does, however, sit in the path of web requests that your web pages make on the sites you enable. It is important to understand what that does and does not mean:

Mockadabra does not stop websites or their backend services from receiving data. Requests that it passes through, and requests of rules that modify a real response, are sent to the real server by the page, exactly as the page made them (plus only the changes a rule you wrote asks for). The server receives whatever the page and your browser normally send.
When a rule mocks a request or simulates a network failure, that request is answered or failed locally and is not sent to the real server.

Three kinds of requests

1. Requests made by the web pages you use (intercepted or passed through)

On sites that you enabled and Chrome granted, Mockadabra wraps the page's fetch and XMLHttpRequest. For each request it reads the method, the URL, the headers the page's script set and, for requests with a text body, a short preview (up to 16,384 characters) in memory, to decide whether one of your rules matches. Then:

What happens to a request, and whether it reaches the real server
What happens	Reaches the real server?
No rule matches	Yes — unchanged
A rule passes through while adding request headers	Yes — with the headers you configured added
A rule modifies the real response	Yes — the real server answers; Mockadabra changes the response in the page according to your rule
A rule mocks the response	No — answered locally
A rule simulates a network failure	No — failed locally
The engine cannot decide (for example a configuration error)	Depends on your failure policy: non-mutating requests continue unchanged; by default mutating ones (POST, PUT, PATCH, DELETE) are blocked rather than sent

A mocked response is delivered to the page that made the request. Scripts of that page — including third-party scripts it loads — can read it like any other response. Mockadabra does not hide its own activity from the page.

2. Requests initiated by the extension itself

None for uploading or synchronizing your data. Mockadabra has no publisher/backend requests, analytics, advertising or cloud synchronization. Its hook invokes the page's native network APIs only for that page's requests described above. All extension code, fonts and images are packaged locally; it loads no remote executable code.

3. Data stored locally on your device

Described in the next section.

What is stored locally

All of this lives in your browser profile (the extension's IndexedDB and chrome.storage) and is removed when you uninstall the extension:

Configuration you create — projects, groups, rules, response definitions (status, headers, bodies, delays), environments, variables, enabled-site lists and settings.
Secret variables you create — stored unencrypted, including local copies needed to serve recently published configurations. They are masked in the dashboard and excluded from exports unless you opt in. Newly written diagnostic entries do not contain secret values. A rule can place a secret into a response or permitted request header only if you explicitly allow it for that rule; the receiving page or server can then read that value.
Optional activity diagnostics — persistent logging is disabled by default for new installations and whenever saved preferences are missing or invalid. Existing valid logging preferences are retained, including an existing enabled preference. When enabled, the bounded local log keeps up to 500 entries by default (or the saved limit). New entries contain timestamps, severity, fixed event codes/messages and limited numeric publication metadata; they do not contain request URLs or paths, HTTP methods, project/rule identifiers, request/response bodies, header values, credentials, raw exception messages or untrusted report reasons. Unknown diagnostic codes are discarded. All activity writers, including publisher events, honor the preference. Earlier entries are not rewritten or deleted by this update: they may contain URL paths, URL-embedded credentials or diagnostic text and remain subject to the existing ring-buffer limit if logging is enabled. Version 0.1.1 has no screen to inspect, enable/disable or clear this log; ordinary new installations cannot enable it through the interface.
Per-tab choices — which project/environment (or “off”) each tab uses, in chrome.storage.session, which Chrome clears when the browser restarts and when the tab closes.
Safety copies — before an import, a copy of your own workspace is kept in the profile (the newest 10). These local restore points include secret variable values and are not encrypted. Downloads from the Safety copies screen omit secret-variable values.
The current tab's address — when you open the toolbar popup, the extension reads the URL of the tab you opened it on (Chrome's activeTab permission) to show whether Mockadabra is active there. It is not stored.

The extension also retains publication status needed by its diagnostics interface (configuration revisions, counts, the last publication time and a controlled failure code/message). This status exists even with activity logging disabled. New failure status does not store arbitrary exception text; earlier saved status is not scrubbed by this update.

Request details described under "Three kinds of requests" (URLs, headers, body previews, real responses being modified) are processed in memory, not automatically saved as new diagnostics. The bridge keeps up to 50 recent decisions in memory, including query/fragment-stripped URLs, for extension-only status queries. User-entered/imported configuration may itself contain URLs, bodies, headers or identifiers; those deliberately saved values are not removed by diagnostic sanitization.

Mockadabra does not read your cookies, passwords, browsing history or page content beyond what is described here, and it only runs on sites that are both enabled by you and granted by Chrome.

Where data goes

Nowhere outside your device, by the extension. It does not sell, share or transfer user data, and does not use it for advertising, creditworthiness, lending or any purpose unrelated to its single purpose (mocking and modifying API responses for development and testing).
The web requests that pages make to their own servers are the page's traffic, not the extension's; see the table above.
Mockadabra cannot protect data you choose to put into a mock: do not store production credentials in responses or variables.

Chrome Web Store Limited Use

Mockadabra's use of user data adheres to the Limited Use restrictions of the Chrome Web Store User Data Policy. Data is used only to provide and maintain its disclosed API-mocking/testing functionality, not for advertising or profiling. Mockadabra does not send it to the publisher or sell it. The publisher does not receive or inspect your local configuration automatically; if you request support, share only the specific, reviewed information you consent to have read.

Import and export

Export writes a plain-text JSON file to your computer (Downloads folder) only when you ask. Secret values are left out unless you tick the option to include them; if you do, the file is not encrypted and its name says so. Activity logs and per-tab choices are never exported.
Excluding secret-variable values does not remove sensitive content manually placed in response bodies, header definitions, URLs or ordinary variables. Review every export before sharing it. Exported files are outside extension storage and are not removed by uninstalling Mockadabra.
Import reads only a file you choose, validates it completely, and writes nothing until you confirm. Importing never grants Chrome site access.
Generic JSON Import: if the chosen file is not a Mockadabra backup, compatible static HTTP mock configurations in it (up to 1 MiB) can be analyzed and converted locally, on your device; the file is not uploaded or sent anywhere. After you review and confirm, conversion creates a new, disabled project with no enabled sites. It does not change your existing projects or settings, and it does not grant any website permission automatically: Mockadabra runs on a site only after you enable that site and Chrome grants access. The review screen does not display imported response bodies or header values, but converted rules — including any credentials or personal data the file contains — are stored like any other configuration (unencrypted), are included in later safety copies, and are included in project or workspace exports.
Where you keep exported files (cloud drives, repositories, e-mail) and who can read them is your responsibility.

Permissions and why they exist

Browser permissions requested by the extension
Permission	Why
`storage`, `unlimitedStorage`	Keep your projects, rules, settings and safety copies locally; mock bodies and backups can be large
`scripting`	Register Mockadabra's packaged page scripts on the sites you enabled and granted
`activeTab`	Let the popup read the address of the current tab to show its status
Optional access to `http:///` and `https:///`	Not granted at install. Chrome asks you, per site and from a click; you can revoke each site at any time in `chrome://extensions` → Mockadabra → Site access

Your choices and control

Delete part of your data: delete rules, groups, environments, variables or whole projects in the dashboard. Importing a workspace file in Replace mode replaces everything.
Stop it running on a site: switch mocking off for a tab in the popup, remove the site from the enabled sites, or revoke the site's access in Chrome.
Delete all data, including the activity log: uninstall the extension (chrome://extensions → Remove); Chrome deletes the extension's storage with it.
Keep a copy: Backup → Export workspace.

Children

Mockadabra is a software-development tool and is not directed at children.

Security

Mockadabra does not encrypt its locally stored configuration, secret values, safety copies or exported JSON files. Browser-origin isolation and your operating-system account provide access boundaries, not application-level encryption. Do not store production credentials or sensitive real-user data. Please report security issues privately to lacosta.code@gmail.com.

Diagnostic privacy hardening does not encrypt stored configuration or secrets. Whether this plaintext authentication-storage design satisfies Chrome Web Store encryption-at-rest requirements remains unresolved; this policy is not a guarantee of store-policy compliance or approval.

Changes to this policy

If a future version changes what the extension processes or transmits, this policy will be updated and the change described in the extension's release notes before that version is published.

Contact

lacosta — lacosta.code@gmail.com