Copy for the submission form. Kept in the repo so it is versioned alongside the behaviour it describes.
Wiretype
Warns you when third-party trackers read what you type into forms — before you ever press Submit.
(118 characters.)
The extension has one purpose: to detect third-party scripts reading the contents of form fields on the current page, and to warn the user about it.
Reviewers reject listings whose stated purpose is broader than the code. This one is narrow on purpose.
Most people assume the data they type into a web form is sent when they click Submit. Often it is sent well before that.
Academic measurement of the top 100,000 sites found email addresses being exfiltrated to tracking and analytics domains before form submission on thousands of them — in many cases with no submit click at all, and regardless of the user's consent choices. Session-replay scripts go further and capture keystrokes as they are typed.
Existing tools do not cover this. Ad blockers block known domains by URL, which does nothing about a first-party-bundled script or one that is allowed through. Policy summarisers read published terms, which describe intent rather than behaviour. Neither one tells you what a page is doing to the field your cursor is sitting in.
Wiretype watches the page as it runs:
• Before you type — it identifies scripts on the page that are known to read form fields, and tells you they are there.
• As it happens — if a third-party script actually reads a field, the field is outlined in red and the responsible vendor is named.
Two levels of warning, kept deliberately distinct: amber means a known form-reading vendor is present, red means we watched one read your data.
Privacy: the extension has no server and no account. What you type is never read, stored, or transmitted by it — the contents of a field are used only to check whether the field is empty. Everything runs locally.
Performance: measured at under 0.1 ms added per keystroke on a 30-field React form with a session-replay script running.
host_permissions (<all_urls>)
Form-field harvesting occurs across the whole web, including on sites the user
visits once. The extension cannot know in advance which pages require watching,
so it must run its local check on any page with a form. It performs no network
requests and transmits nothing.
storage Reserved for user preferences such as per-site muting. No browsing history and no form data is written to it.
sidePanel Renders the findings panel beside the page: which vendors were detected, which fields each one read, and what the user can do about it. It displays locally held data and makes no network requests.
Remote code: none. All scripts, including the tracker list, are bundled in the package. Nothing is fetched or evaluated at runtime.
Answer No to every collection category. The extension collects nothing: no personally identifiable information, health information, financial information, authentication information, personal communications, location, browsing history, or user activity.
https://github.com/flyhighbarney/wiretype/blob/main/PRIVACY.md
Mandatory for any listing that requests host permissions. The GitHub blob URL is used deliberately rather than a separate hosted page: it renders properly, it is public, and it is the same file a reviewer can read next to the source it describes — so the policy cannot quietly drift from the behaviour it claims.
- The amber pre-warning banner on a page with a known vendor loaded.
- A red outline on a field with the tooltip naming the vendor.
- The side panel open beside a form, showing the summary and which fields were read.
- Side-by-side of a form with and without the extension, showing it stays readable.
Privacy & Security