What we collect

Almost nothing. Kernel DevTools does not collect, transmit, or sell any personal data. There is no analytics SDK, no crash reporter, no A/B testing framework, and no usage tracking of any kind.

The only exception is the optional ad-unlock flow described below, which stores an anonymous token on our server for up to 24 hours.

What is stored on your device

The following data is stored locally on your device only using chrome.storage.local and is never transmitted anywhere except where noted:

Mock API rules — URL patterns and response definitions you create in the Mock tab. Stored locally; never sent to any server.
API collections — request collections and environment variables you build in the API Tester tab. Stored locally only.
Device ID — a randomly generated UUID created the first time you use the extension. It is not linked to your identity and is used only to associate an unlock token with your device during the ad-unlock flow.
Unlock state — if you claim an ad-unlock, the expiry timestamp is stored locally so the extension knows your unlock is active without making repeated server requests.
Daily export count — a counter (reset each day) tracking how many exports you have used. Stored locally only.

All other data displayed in the panel (console logs, network requests, cookies, localStorage, DOM snapshots) is read directly from the locally inspected browser tab and shown only to you. It is never stored persistently or transmitted anywhere.

Ad-unlock flow

Some advanced features can be unlocked for 24 hours by viewing an ad on kerneltools.dev. When you choose to do this:

The extension generates a one-time random token (UUID) and opens kerneltools.dev/unlock in a new tab, passing the token, your device ID, and the feature name in the URL.
When you click "Claim 24h unlock", that token is written to our server (Cloudflare D1) with a 24-hour expiry. Only the token, device ID, feature name, and expiry timestamp are stored — no name, email, or IP address is retained.
The extension polls our server to detect when the token has been claimed, then stores the unlock expiry locally and closes the polling loop.
Tokens are automatically deleted after expiry. You are never required to use this feature.

Network requests made by the extension

Kernel DevTools makes network requests only when you explicitly trigger a tool that requires it:

Certificate Inspector — queries crt.sh and hstspreload.org with the hostname you enter to fetch public certificate data.
DNS Leak Checker — queries api.ipify.org to retrieve your public IP address for comparison.
Ad-unlock flow — when you choose to unlock a feature, the extension polls kerneltools.dev/api/check-unlock until the token is claimed, then stops. No requests are made in the background when you are not using the unlock flow.

No other background network requests are made.

Browser permissions used by the extension

The extension requests the following Chrome permissions. Each is used only for the purpose stated below:

host permissions (<all_urls>) — Required to intercept and inspect network requests, response headers, cookies, and security policies on any webpage you are actively debugging. Access is limited to the tab open in the DevTools panel and is never used for background data collection.
scripting — The chrome.scripting API injects a lightweight content bridge into the inspected tab. This bridge relays console messages, DOM mutations, WebSocket frames, and storage change events to the DevTools panel in real time. No code is injected into tabs you are not actively inspecting.
storage — chrome.storage.local stores mock API rules, unlock state, layout preferences, and export counters locally on your device. See "What is stored on your device" above for the full list.
tabs — The chrome.tabs API is used to identify the active tab being inspected, retrieve its URL for the Network and Security panels, and reset panel state when you navigate to a new page.
alarms — chrome.alarms fires a periodic check to verify whether an ad-unlock token has expired. This keeps the panel badge accurate without requiring a page reload. No alarm data is transmitted externally.
remote code execution (inspectedWindow.eval) — The extension uses chrome.devtools.inspectedWindow.eval(), the standard Chrome DevTools API, to read DOM state, retrieve storage values, and relay console output from the inspected page's JavaScript context. All evaluated strings are generated locally within the extension; no code is fetched from any remote server.

Kernel Ludo (kerneltools.dev/ludo)

Kernel Ludo is a website feature, not part of the extension — everything above this section describes the extension itself, which Kernel Ludo has no access to and never touches. Playing a live multiplayer game means real-time data has to leave your device by design, so this section is separate and explicit about exactly what that involves.

What's sent — the display name you're shown with, and your connection's IP address (inherent to any live connection, not something we choose to log beyond what Cloudflare's own infrastructure sees to route the connection). No account, email, or persistent identity is created or required.
What's stored — nothing durable. A room's state (who's connected, whose turn it is) lives only in that room's server memory for as long as the room is active, and is gone once everyone leaves or the room is closed. There is no database of past games, players, or room codes.
Voice chat — Kernel Ludo has optional voice chat between players in the same room, connected directly peer-to-peer (WebRTC) rather than routed through our server — our server only ever relays the connection-setup handshake, never the audio itself. This means each player's real IP address becomes visible to the other players they're in a room with, for as long as voice is connected — a standard characteristic of peer-to-peer voice/video, not something unique to how we've built this. Voice is off by default: it's only ever turned on by an explicit click, and you can mute your own mic at any time, or turn it off entirely by leaving the room.

Third-party services

Kernel DevTools does not integrate any third-party analytics, advertising, social, or tracking services inside the extension.

The kerneltools.dev/unlock web page displays an advertisement served by Google AdSense. When the unlock page loads, Google may collect your IP address and browser information as part of serving and measuring ads. Google's privacy practices are governed by the Google Privacy Policy. You are only exposed to Google AdSense when you choose to open the unlock page — it is never loaded inside the extension itself.

The only other third-party network calls are the user-triggered ones listed above (crt.sh, hstspreload.org, ipify.org) — all of which send only the minimum data needed to answer your query.

Changes to this policy

If this policy ever changes, the updated version will be published at this URL and the "Last updated" date at the top will be changed. We will also note the change in the Release Notes.

Contact

Questions? Report an issue or email [email protected].