Privacy Policy — Syncmock

Short version: Syncmock does not collect, transmit, or sell any of your data. All request and response traffic stays on your machine. The extension has no telemetry, no analytics, and requires no account.

What Syncmock stores locally

Data	Location	Purpose	Retention
Rules you create	chrome.storage.local	Rule engine	Until you delete them
Interception on/off toggle	chrome.storage.local	Persist across restarts	Until you change it
In-page notification toggle	chrome.storage.local	Persist across restarts	Until you change it
AI endpoint / model / API key	chrome.storage.local	Enable AI rule authoring	Until you clear it
Recent network entries	Service worker memory (~500 max)	Populate the Network panel	Cleared on service worker sleep or "Clear"

What Syncmock does not do

No telemetry. The extension does not phone home. No usage analytics, no crash reporting, no request logging by us.
No third-party trackers. No ads, no analytics SDKs, no tracking pixels.
No cloud sync. Nothing is uploaded to a Syncmock-operated server at any time.
No account required. You do not sign in, register, or verify an email to use Syncmock.
No data sales. We do not sell, rent, or trade any user data to third parties.

AI features

AI-assisted rule generation is entirely optional. When you use it:

The selected request/response snippet and your prompt are sent to the AI endpoint you configured (e.g. OpenAI, a local Ollama instance, or any OpenAI-compatible API).
Syncmock adds no additional recipients and does not proxy the request through any Syncmock server.
Your API key is stored only in chrome.storage.local and is included solely in the Authorization header of requests to the endpoint you configured.
The third-party endpoint's own privacy policy governs what happens to data on their side.

Chrome permissions we use

storage — persist your rules and settings on your device.
webRequest — observe network events so the Network panel can display metadata. No blocking or modification happens through this API.
declarativeNetRequest / WithHostAccess — apply redirects and header modifications you defined in rules.
scripting — inject the page bridge that patches fetch / XMLHttpRequest so body-touching rules work.
tabs — deliver in-page match toasts to open tabs when notifications are enabled.
host_permissions: <all_urls> — declared because rules are user-defined and can target any origin. No access is exercised until a matching rule exists.

Data deletion

Rules — delete individual rules on the Rules page, or import an empty ruleset to replace all rules.
Network entries — click Clear in the Network panel.
AI API key — clear it in the Settings page.
Everything — uninstall the extension. Chrome automatically removes all chrome.storage.local data associated with the extension on uninstall.

Changes to this policy

If this policy changes materially, we will update the "Last updated" date above and note the change in the CHANGELOG.

Contact

For privacy questions, please open an issue at github.com/khageshgopalpatel/syncmock/issues.