Privacy Policy

Overview

SigInspector is a Chrome DevTools extension for developers. It shows the analytics and experimentation traffic a web page sends (events, feature flag results and experiment exposures from the Statsig, Mixpanel, Amplitude and PostHog JavaScript SDKs) in a panel inside Chrome DevTools, for the tab being inspected.

This policy describes how SigInspector handles the data it sees.

What SigInspector Does

SigInspector adds a script to web pages that watches the page's outgoing network requests. It only looks at requests whose address and contents match one of the supported SDKs: requests to their API domains (for example statsigapi.net, api-js.mixpanel.com, api2.amplitude.com, us.i.posthog.com), and, for Mixpanel, Amplitude and PostHog, the same requests sent through a website's own domain. All other traffic passes through untouched and is not read.

Matching requests and responses are decoded and shown in the SigInspector DevTools panel. SigInspector does not change, block or delay any request.

Capture is tied to the DevTools panel. While no SigInspector panel is open for a tab, the extension discards what it sees and stops reading the traffic. Requests made in the first moments of a page load, before the extension knows whether a panel is open, are held briefly and then dropped if no panel is open.

Data Accessed

SigInspector reads the content of the supported SDKs' requests and responses. Depending on what the website sends, these may include:

• Event names, values and properties
• Feature flag and gate names and their results
• Experiment names and assigned groups or variants
• User and device identifiers and user properties set by the website (for example userID, distinct_id, user_id, device_id, email)
• Page details the SDK attaches to events (for example the page URL, browser and operating system)

This data is used only to display it to the developer using the DevTools panel.

Data Handling

Captured events live in the DevTools panel's memory and in a per-tab buffer of up to 500 events in Chrome's session storage. Session storage is held in memory, not written to disk, and is cleared when Chrome closes. The buffer lets events survive page reloads (the Event memory setting) and the browser briefly pausing the extension in the background. Clearing events in the panel empties it.

SigInspector never sends captured data to any external server, including any server run by the extension's author. The panel's fonts are bundled with the extension, so opening the panel makes no network requests. Links to vendor documentation open only when you click them.

Export JSON saves the captured events to a file on your computer, only when you click it.

Permissions

SigInspector requests one browser permission, storage, and no host permissions. Storage holds the per-tab event buffer in Chrome's session storage (in memory, cleared when Chrome closes) and remembers, on your device, whether the one-time welcome or "What's new" note should be shown after installing or a feature update. No captured data is kept in the device's local storage.

Its content scripts run on all sites. Websites send analytics from their own domains and often through their own servers, so the extension cannot know in advance which sites use these SDKs. The scripts start before the page's own code (document_start) and run in all frames so the first events and events from embedded frames are captured. They are used only to read the matching SDK traffic described above.

No Remote Code

SigInspector does not load or run any remote code. All extension code and assets are included in the extension package.

Children's Privacy

SigInspector is a developer tool for software developers. It is not directed at children and does not knowingly handle data from users under the age of 13.

Changes to This Policy

When this policy changes, the updated version is published at this address with a new "Last updated" date.

Contact

Questions about this privacy policy can be directed to: hello@applied.llc