Privacy Policy — Script Inventory
Last updated: 6 September 2026.
The short version
Script Inventory does not have a server that receives your data. Everything an audit produces stays in your browser. There is no account, no tracking inside the extension, and nothing is sold or shared.
What the extension collects, precisely
During a scan — and only while a scan is running — the extension records, on your device:
| Recorded | Not recorded |
|---|---|
| Script URLs, hostname and path | Script contents of external files |
| How each script loaded (page source, runtime injection) and the apparent injector | — |
integrity, crossorigin, nonce, type, async, defer attributes | — |
| A SHA-256 hash of inline script contents, plus its character length | The inline script text itself |
Names and autocomplete attributes of fields that look like card inputs | Field values — never. Nothing anyone types |
Whether a Content-Security-Policy meta tag exists, and its script-src directive | Other page headers |
| The URL of the page you chose to scan | Any other page you visit |
| The written justifications you type, and the baselines you approve | — |
The extension never reads page content, form input, card numbers or anything a user types.
Why these specific fields
Each one maps to a requirement. Script URLs and integrity attributes are the inventory itself. Inline scripts are hashed rather than stored so that a change is detectable without ever keeping the code. Card-like fields are detected by name only, purely to establish whether the page is in PCI scope — reading their values would be both unnecessary and grossly inappropriate for a tool used on payment pages.
This is the "strictly necessary to the disclosed single purpose" standard the Chrome Web Store requires, applied literally.
Where the data goes
- Inventories, justifications and baselines are stored in
chrome.storage.localon the device that ran them. - Preferences are stored in
chrome.storage.sync, which means they travel through your own Chrome profile if you have Chrome Sync enabled. That is a Google service under your control; the developer has no access to it. - Nothing is transmitted to the developer or to any third party.
There are no exceptions. This extension is free, has no accounts, no licences and no paid tier, so it never contacts any server for any reason. It makes zero outbound network requests of its own — you can verify that in DevTools, or by reading src/background/service-worker.js, which contains no fetch call at all.
Exports
When you export a report, the file is generated in your browser and saved by you. It is not uploaded anywhere. Note that an exported report does contain the scanned URL, every script URL and your written justifications — treat it like any other client document.
Permissions and why each one exists
| Permission | Why |
|---|---|
storage | Save audits and preferences locally. |
scripting | Inject the observation scripts into the page you chose to audit. |
activeTab | Read the URL of the tab you are on, when you open the popup. |
| Host access (optional, per-domain) | Observe the page from the first byte, so scripts present in the source are not missed. Requested one domain at a time, only when you start an audit, and revocable at any moment from chrome://extensions. |
This extension never requests access to all sites.
Data retention and deletion
The most recent 200 are kept on this device. Justifications and baselines are kept independently and are not deleted when scans are. Older ones are discarded automatically. You can delete any individual scan, or all of them, from the Settings page. Uninstalling the extension removes all local data.
Uninstall
Nothing happens when you uninstall. Most extensions open a survey page on uninstall; this one does not, because that would mean depending on a website that has to stay up. All local data is removed by Chrome when the extension is uninstalled.
Children
This is a professional developer tool. It is not directed at children and does not knowingly collect data from anyone.
Changes
If the data practices ever change, the extension will notify you inside the product before the change takes effect, as the Chrome Web Store disclosure policy requires. This document will be updated with a new date.
Contact
faustino20161@gmail.com