Privacy Policy

Mockrew is built so that debugging data stays where it belongs — on your machine. This policy explains exactly what is stored locally, what reaches our servers (only if you create an account), and what never leaves your browser at all.

1. Summary

• Your API traffic is never uploaded. Request URLs, headers, cookies, tokens, request bodies and response bodies stay in your browser.
• The extension works without an account. Rules, projects and preferences live in chrome.storage.local.
• An account stores only what is needed to sell and deliver Pro — identity, subscription status and connected browser records.
• No advertising or analytics trackers run on this website, and the extension contains no telemetry.

2. What we collect

What those bases mean. "Contract" is data we need to give you the account or the plan you asked for. "Legitimate interests" is data we use to keep the Service secure and working; we have weighed that against your rights, and you can object to it at any time — see section 8.

You are not required by law to give us any of this data, and nothing here depends on you supplying more than the minimum. If you do not create an account, the extension still works and we hold nothing about you on our servers.

Where you sign in with GitHub or Google, the name, email address and avatar URL come from that provider, at your instruction. We do not receive your password or your activity on those services.

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

We do not collect payment card details. Card data is entered on the merchant of record’s checkout and never reaches us; we receive only a transaction reference, the plan purchased and its status.

3. What we never collect

• The URLs, headers, cookies or bodies of requests made by pages you debug.
• Response bodies — including those you choose to capture into the request log, which stay in memory on your device.
• Page content, form input, keystrokes or screenshots.
• Browsing history or a list of the sites where the extension is active.
• Any data from the extension while you are not signed in.

The extension asks for access to all sites, because a mocking tool has to run on whatever page you are debugging and that scope cannot be narrowed in advance. The permission is used only to install the request interceptor in pages you open. No page content, URL, header or body is sent to us.

4. Storage on your device

Rules, projects, response bodies, JS Hook source and UI preferences are stored in chrome.storage.local, which Chrome caps at 10 MB per extension. The request log is held in memory and cleared when DevTools closes. Uninstalling the extension deletes this local data — export first if you want to keep it.

5. Cookies

This website sets a small number of first-party cookies, none of them for advertising. The site is currently available in English only, so the language cookie is set only if a language switcher is shown and you use it:

You can clear them at any time in your browser settings; clearing the sign-in cookie signs you out. The extension itself sets no cookies. Because we use no analytics, advertising or third-party cookies, you will not see a consent banner — there is nothing to consent to.

6. Third parties

We do not sell personal data, and we do not share it for advertising or for cross-context behavioural advertising. We may disclose data if required by law or to protect the rights and safety of users.

Google user data

Signing in with Google is optional. When you use it, Google shares only the basic profile scopes (openid, email, profile): your name, email address and profile picture URL. We do not request access to Gmail, Google Drive, Calendar or any other Google service, and we never receive your Google password or your activity on Google.

• Use — only to create and identify your account, to show your name and avatar, and to contact you about the Service.
• Storage — in our Cloudflare-hosted database, for as long as your account exists.
• Sharing — not sold and not shared with third parties, except our hosting provider Cloudflare, which processes it on our behalf, or where the law requires disclosure.
• Retention and deletion — deleted within 30 days of account deletion; you can request deletion at support@mockrew.com at any time.
• Human access — no one reads your Google user data, except for security purposes, when you ask us for support, or where the law requires it.

The use and transfer of information received from Google APIs by Mockrew adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, to train AI models or to build profiles.

7. Retention

• Account data — kept while the account exists, and deleted within 30 days of a deletion request.
• Connected browser records — kept until you unbind the browser or delete the account; expired connections are pruned automatically.
• Subscription and invoice records — kept as long as tax and accounting law requires (typically 7–10 years), held by the merchant of record.
• Server logs — rotated and deleted within 30 days.
• Support email — kept for up to 24 months after the issue is resolved.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy in a portable format. To exercise any of these, write to support@mockrew.com; we respond within 30 days and do not charge for it.

We do not rely on your consent for any of the processing described here, so there is no consent to withdraw. If that ever changes — for example if we add an email newsletter — we will ask you first, and you can withdraw at any time.

You also have the right to complain to your local data protection authority. We would appreciate the chance to resolve the issue first.

9. International transfers

Our hosting, database and payment providers may process data outside your country, including in the United States and the European Union. Where the law requires a safeguard, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission’s Standard Contractual Clauses. Your API traffic is not transferred at all, because it never leaves your browser.

10. Children

The Service is a developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.

11. Security

• All traffic to this website and its API is encrypted with HTTPS.
• Session cookies are HttpOnly, SameSite=Lax, and Secure in production.
• The private key that identifies a connected browser is generated in your browser, stored non-exportably and never leaves it. Our server stores only an identifier derived from the public key.
• Access to production data is limited to authorised personnel, and only for support and security work.

12. Changes to this policy

If we change how data is handled, we update this page and the date at the top. Material changes are announced on this page at least 30 days before they take effect, and we will email account holders where the change affects them directly.

13. Contact

Privacy questions and data requests: support@mockrew.com.