Pico API ("the extension", "we", "us") is a developer tool that runs entirely inside your browser. This policy explains what data the extension accesses, how it is stored, and the choices you control.
TL;DR. The extension does not collect, transmit, or sell any personal data. Every piece of data it reads — saved requests, folders, environments, history, settings — is stored locally in your browser profile via IndexedDB and localStorage. Nothing leaves your machine except the HTTP requests you explicitly send to the URLs you typed in.
All of the following live in your browser's own storage (IndexedDB on the extension's origin, plus localStorage for settings). They are not synced to any server and are not accessible to websites you visit.
| Data | Where | Purpose |
|---|---|---|
| Saved folders and requests | IndexedDB | Lets you build a reusable API collection |
| Request drafts | IndexedDB | The request you're currently editing |
| Response history (capped) | IndexedDB | "Resend" / time-travel over recent responses |
| Environments and variables | IndexedDB | Variable substitution ({{baseUrl}}) |
| App settings (theme, locale) | localStorage | Remembers your UI preferences |
To wipe all local data, remove the extension from chrome://extensions — that deletes everything stored on the extension's origin. You can also export your collection to a JSON backup file (Settings → "Data backup") and restore it later; restoring replaces all current data.
To let you call APIs that depend on your browser session, the extension can attach the cookies your browser has already stored for the target URL. When the "Send browser cookies" setting is enabled, the extension uses chrome.cookies.getAll() to read those cookies and injects them as a Cookie header on the outgoing request. This setting lives in Settings and is enabled by default; you can turn it off at any time. If you set your own Cookie header on a request, yours wins and the browser jar is not read. The extension never modifies, sets, or deletes cookies.
When you send a request, the extension makes an HTTP call from the service worker directly to the URL you entered. The request body, headers, and any response received are processed locally to render the response panel. They are not logged, tracked, or transmitted anywhere else.
| Permission | Why it's needed |
|---|---|
cookies | Attach the browser's stored cookies to your requests ("Send browser cookies" setting) |
host_permissions: <all_urls> | You can test any API endpoint; the extension makes no background network calls of its own |
The extension makes no background network requests of its own. Every outbound HTTP call is one you explicitly triggered by clicking Send.
The extension does not load any third-party scripts, does not use analytics, does not embed advertising, and does not call any external API. There are no external service dependencies.
The extension is a developer tool and is not directed at children under 13. We do not knowingly collect any data from anyone, regardless of age.
Material changes will be reflected by updating the "Last updated" date at the top of this document and bumping the extension version number.
For privacy questions or data-removal requests, open an issue on the extension's GitHub repository (linked from the Chrome Web Store listing) or from the extension's Settings → Feedback link.