Pico API ("the extension", "we", "us") is a developer tool that runs entirely inside your browser. This policy explains what data the extension accesses, how it is stored, and the choices you control.
TL;DR. The extension does not collect, transmit, or sell any personal data. Every piece of data it reads — saved requests, folders, environments, history, captured traffic, settings — is stored locally in your browser profile via IndexedDB and localStorage. Nothing leaves your machine except the HTTP requests you explicitly send to the URLs you typed in.
All of the following live in your browser's own storage (IndexedDB on the extension's origin, plus localStorage for settings). They are not synced to any server and are not accessible to websites you visit.
| Data | Where | Purpose |
|---|---|---|
| Saved folders and requests | IndexedDB | Lets you build a reusable API collection |
| Request drafts | IndexedDB | The request you're currently editing |
| Response history (capped) | IndexedDB | "Resend" / time-travel over recent responses |
| Environments and variables | IndexedDB | Variable substitution ({{baseUrl}}) |
| App settings (theme, locale) | localStorage | Remembers your UI preferences |
| Captured network requests | In-memory only (transient) | Shown live while you capture; cleared on extension reload |
Captured network requests are kept in the service worker's memory and are never written to disk. They vanish when the service worker is suspended or the browser is closed.
To wipe all local data: open the extension's Settings → "Data backup / restore" → "Erase all data". You can also remove the extension entirely from chrome://extensions, which deletes everything stored on the extension's origin.
The capture feature uses the chrome.debugger API. It only runs while you have explicitly clicked "Start Capture" on a specific tab, and stops the instant you click "Stop Capture", close the tab, or the service worker suspends. While capturing, the extension observes HTTP requests and responses made by that tab and shows them in the side panel so you can replay them.
The captured data:
While the debugger is attached, Chrome shows a banner reading "Pico API is debugging this browser". This banner is added by Chrome itself, not by the extension, and is removed as soon as the capture stops.
When you toggle "Send browser cookies" on a request, the extension uses chrome.cookies.getAll() to read cookies the browser has stored for the target URL and injects them as a Cookie header on that one outgoing request. This lets you call APIs that depend on a browser session without leaving the extension. The toggle is off by default and must be enabled per request. The extension never modifies, sets, or deletes cookies.
When you send a request, the extension makes an HTTP call from the service worker directly to the URL you entered. The request body, headers, and any response received are processed locally to render the response panel. They are not logged, tracked, or transmitted anywhere else.
| Permission | Why it's needed |
|---|---|
cookies | Optional cookie injection for authenticated APIs (off by default) |
sidePanel | The main UI is hosted in the Chrome side panel |
debugger | Network capture (only while you have started a capture on a tab) |
host_permissions: <all_urls> | You can test any API endpoint; the extension makes no background network calls of its own |
The extension makes no background network requests of its own. Every outbound HTTP call is one you explicitly triggered by clicking Send.
The extension does not load any third-party scripts, does not use analytics, does not embed advertising, and does not call any external API. There are no external service dependencies.
The extension is a developer tool and is not directed at children under 13. We do not knowingly collect any data from anyone, regardless of age.
Material changes will be reflected by updating the "Last updated" date at the top of this document and bumping the extension version number.
For privacy questions or data-removal requests, open an issue on the extension's GitHub repository (linked from the Chrome Web Store listing) or from the extension's Settings → Feedback link.