1. What this page covers
This page explains what data PayloadPigeon processes, how the local library is protected, and what happens when you send requests, export files or affirmatively opt in to aggregate usage telemetry. The extension, optional telemetry, website, learning Playground, and support enquiries involve different data flows. See the Privacy Policy for details.
2. Data and recipients
| Data | Where / recipient | Control |
|---|---|---|
| Temporary Traffic | Extension session storage | Start, Stop, Clear and the documented Capture lifecycle |
| Saved library | Encrypted local extension storage; some technical metadata remains open | Local password, recovery key, Lock and deletion |
| Website analytics | Cloudflare Web Analytics via Automatic setup | Aggregate website usage and performance only; no advertising or session replay; separate from extension telemetry |
| Optional extension usage telemetry | Cloudflare Workers Analytics Engine | Off by default; affirmative opt-in; aggregate allowlisted counters only |
| Backend Send, Ready and enabled Rules | User-selected server or tested page | Real network or page effects; review the active Test or Rule |
| Downloaded files | User-selected device and later recipients | Readable JSON/Markdown or a package with a separate file password |
| Playground | PayloadPigeon demo service and its infrastructure | Sample data only; page controls and Backend Send can reach its endpoint |
| Website / support | Hosting and email providers | Separate Privacy Policy and contact choices |
3. Permissions
| Permission | Purpose and activation | How it stops |
|---|---|---|
| debugger | Supported Capture and modification for the selected tab | Use Stop for Capture; disable or uninstall the extension to stop its use |
| sidePanel / tabs | Workspace UI and selected-tab context | Closing the panel does not revoke tabs access; disable or uninstall the extension to stop its use |
| storage | Temporary state and saved work | Use the matching Clear, delete or Lock control; uninstall removes extension access |
| unlimitedStorage | Required capacity beyond Chrome’s standard local quota behavior | Used by the installed extension; disable or uninstall it to stop use. Disk space and product limits remain finite |
| Optional HTTP/HTTPS host access | Selected Backend HTTP destination | Revoke the optional site access in Chrome; it is separate from required permissions |
4. Capture and library lifecycle
| Action | Capture / runtime Traffic | Saved library |
|---|---|---|
| Start capture this tab | Starts selected-tab Capture | Does not create or unlock the library |
| Stop | Ends active Capture | Does not Lock or delete saved data |
| Clear Traffic | Clears the applicable temporary list | Does not delete Tests/Results |
| Last panel closes | Ends Capture after up to 1 s reconnection grace | Does not equal Lock or revoke tabs access |
| Top-level origin changes | Ends the accepted Capture scope | Saved library remains |
| Lock | Ends supported work and clears relevant temporary values, the unlock key and drafts | Keeps the encrypted library |
| Chrome restart / extension reload, update or disable | Requires unlock after the session key is lost | Encrypted library remains |
5. Password, recovery and protection boundaries
Masking hides a value on screen; redaction removes or replaces it in a particular representation; encryption protects saved content with key material. They are not interchangeable. Saved collections use AES-256-GCM before local persistence. In the unlocked state plaintext and key material exist in memory/session storage. Protection does not guarantee physical erasure or defend a compromised OS, browser profile or privileged extension context.
6. Credential modes
| Mode | What it does | Limit |
|---|---|---|
| Current session | Uses an eligible recent captured header from the same context | Stops on missing, ambiguous or mismatched context; no promise for arbitrary body/query credentials |
| Don't send | Omits the selected header | Does not remove cookies or every form of authentication |
| Test value | Stores and sends the chosen literal | Can be a real secret despite its name; use synthetic values |
Cookie, Set-Cookie and Proxy-Authorization are not ordinary editable Test values. Heuristic warnings and evidence sanitisation are separate controls.
7. Exports and sharing
| Format | Protection | Contents / limits |
|---|---|---|
| Standard JSON bundle | Readable plaintext | Selected Plan content; optional history/evidence; not runtime, Advanced Rules or settings |
| Protected package | Separate file password | Recipient previews and explicitly imports into their own protected library |
| Markdown Result | Readable plaintext report | Not an import format; may include selected saved evidence |
The author’s local password/recovery key is never shared as the file password. Import is Protect/Unlock → Choose file → file password if protected → preview/review → explicit Import. Import never starts Capture, Send, Ready or Current Check.
8. WebSocket and page boundary
Supported control is limited to compatible page text/JSON sockets. Early sockets may require reload/new connection; Worker, binary and ambiguous sockets can be observe-only. Network verified is not a business-success verdict, and Related server message is not simply the next incoming frame. The tested page receives messages intended for it but must not receive unrelated extension data. No exploit details are published here.
9. Playground data notice
Requests and messages that you direct to the Playground endpoint are processed by the PayloadPigeon demo service. This includes the page controls and a Backend Send aimed at that endpoint. Application code keeps values only for the request or WebSocket connection and does not write them to a database, KV, files or analytics. See Privacy Policy § Playground for infrastructure handling and the details confirmed for publication.
10. Report a vulnerability
Report a suspected vulnerability privately to security@payloadpigeon.com. Include the PayloadPigeon and Chrome versions, concise reproduction steps, the expected and observed impact, and sample data from a system you own or are authorised to test.
Do not include live credentials or third-party data, and do not use denial of service, social engineering or systems without permission. A bounty, fixed response time or remediation deadline is not promised.