Last updated: 27 July 2026
The extension does not collect, store, transmit, or sell any data. There is no server. There is no account. Nothing leaves your browser.
Wiretype watches for third-party scripts reading the contents of form fields on pages you visit, and warns you when it sees one.
To do that it must be present when a page's own scripts run. It observes that a script read a field. It does not read, copy, or transmit what you typed.
Field contents are used for exactly one thing: checking whether the field is empty. An empty field is not worth warning about.
That check happens inside a single function in sensor.js. The value is never
assigned to a variable that outlives that function, never written to storage,
never included in a message, and never logged. Everything downstream of that
function — the on-page warnings, the side panel, the badge count — receives
only:
- an opaque field identifier (
wt-1,wt-2, …) - the name of the vendor that performed the read
- the position and size of the field on screen, to draw the outline
The code is short and the invariant is stated at the top of the file so it can be checked rather than taken on trust.
Per-tab findings, held in memory by the extension's service worker so the side panel can display them:
- the names of vendors detected on the page
- the labels of fields that were read — the page's own wording, such as "Email address", taken from the site's markup
- the type of those fields (
email,tel, and so on)
Field labels are text the website author wrote. They are not anything you typed. The contents of a field are never included.
This is discarded when you navigate away or close the tab. It is never written to disk and never leaves the device.
The extension requests the storage permission for future user preferences
(such as muting a site). No user data is placed in it.
| Permission | Why |
|---|---|
host_permissions: <all_urls> |
Form-field harvesting can happen on any site. The extension cannot know in advance which pages need watching. It runs the same local check everywhere and sends nothing anywhere. |
storage |
Reserved for user preferences. No browsing or form data is stored. |
sidePanel |
Displays the findings panel beside the page. Renders local data only; it makes no requests. |
The extension requests no network access of its own and makes no outbound requests.
None. No analytics, no crash reporting, no telemetry, no remote configuration. The tracker list ships inside the extension and is updated only when you install a new version.
This extension's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: no data is collected, so no data is transferred, sold, or used for advertising, credit assessment, or any purpose other than the user-facing feature described above.
Open an issue on the project repository.