Privacy Policy — Ntercept

Summary

Ntercept is a local HTTP traffic capture and analysis tool. This document describes exactly what it stores, where, and under what circumstances anything leaves your machine.

• No backend, no account, no sync, no analytics, no telemetry. The extension makes no network requests of its own, except the ones you explicitly trigger with the Replay feature.
• Everything is stored locally, in the browser profile where the extension is installed.
• Data leaves your machine only when you make it leave: exporting a file, or replaying a request to its original destination.

1. What is captured

While a capture is running, and only for the single tab you started it on, Ntercept records — depending on the capture profile you selected:

URLs, headers and bodies routinely contain cookies, authorization tokens, API keys, session identifiers and personal data. Ntercept does not attempt to distinguish "sensitive" from "not sensitive" while capturing — it records the traffic as it is. What it offers instead is the set of controls in section 3.

Nothing is captured while no capture is running. Other tabs, other windows and background browser traffic are not recorded.

2. Where it is stored

• Captured requests and sessions: IndexedDB (database Ntercept) in your browser profile.
• Settings, language, theme, active-capture state, floating button position: chrome.storage.local, also in your browser profile.

Both are local to the machine and the browser profile. They are not synced across devices. Uninstall the extension, or clear the browsing data for it, and both are gone.

3. Controls you have

Capture profile

Choose Metadata or Headers to never record bodies at all. These profiles also skip the Chrome debugger entirely.

Redaction (opt-in)

In Settings, enable redaction and list the headers and body fields to hide. Matching values are replaced with [REDACTED] before the request is written to storage — so the original never exists on disk, and cannot appear in an export, a replay or a generated code snippet. It is off by default because debugging authentication is a legitimate use of this tool.

Body redaction covers JSON bodies (at any depth) and form bodies (application/x-www-form-urlencoded and multipart/form-data, which is normalised to key/value pairs on capture). Bodies in other formats — plain text, XML, protobuf, or any binary payload — are not filtered: rewriting arbitrary text by pattern would either miss values or corrupt the body, and a corrupted body is worse than an unredacted one. For those, rely on a stricter capture profile. Response bodies are filtered as JSON only.

Secret detection

A local catalog of patterns flags requests that appear to contain credentials — JWTs, AWS/Google/Slack/GitHub keys, Bearer and Basic authorization headers, and generic key=value secrets. It is an audit aid, not protection — the values are still stored. Exporting a session with detected secrets requires confirmation.

Per-session cap

A configurable maximum number of requests per session. When reached, recording pauses and the UI tells you. Nothing is deleted automatically — Ntercept never discards captured data on its own.

Deletion

Delete an individual session (it removes its requests too) or use Clear all. A session that is currently being captured cannot be deleted; stop the capture first (the UI offers to do both in one step). Deletion is immediate and permanent — there is no trash and no backup.

Export

HAR, cURL bundle, JSON dump or Postman collection, for the whole session or the filtered subset. Exported files are plain text and contain everything that was captured, including any credentials. Handle them accordingly.

4. When data leaves your machine

There are exactly two paths, both initiated by you:

• Export — writes a file to your Downloads folder. What happens to it afterwards is up to you.
• Replay — sends a real HTTP request to the URL you replay, from your browser, using the extension's host permissions. The destination server receives whatever you send it. Requests with state-changing methods require an extra confirmation.

Ntercept never uploads captured data anywhere, and has no server component to upload it to.

5. Permissions

If a permission is in the manifest, it is because a feature depends on it. Nothing is requested "just in case".

6. Children's data / third parties

Ntercept collects nothing about you as a user — no identifiers, no usage statistics — and shares nothing with third parties, because it communicates with no third parties.

7. Changes

This policy is versioned with the code. Material changes will be noted in the release notes, and the last-updated date at the top of this page changes with it.

8. Contact

Privacy questions?