Privacy and data handling
Local inspection and saved reports
Source viewing, supported formatting, package search and static checks run locally without executing the inspected extension. Local packages, cached reports and exported findings can contain sensitive source or credentials. Device storage is not an encrypted vault. We do not monitor your general browsing history. Device-local controls let you review exact cache key names before removing selected reports, or explicitly forget legacy saved Google key/model settings. They do not erase purchased balances, recovery references, server records, provider copies or Chrome history/cookies.
Optional AI submissions
AI Decompile sends the selected source sample, up to 24,000 characters, to the X-Ray backend and its configured Google Gemini provider after your confirmation. Deep Spec sends the disclosed manifest and report metadata/findings. Basic redaction can miss secrets: review input and send only material you are allowed to share. Operation receipts contain credit/request metadata, not the inspected source or generated result. Provider and hosting handling are governed by their terms and settings; we do not promise that third-party systems have zero retention or never use data for training.
Google sign-in and account records
Google/Firebase sign-in provides a verified email and user ID, display name and profile image. The backend verifies ownership and stores account, credit grants/expiry, purchase references and usage/recovery records. The client keeps bearer credentials in browser session storage. We do not request Gmail, Drive or contact access. A remote profile image may contact its image host. Sign-out clears the local signed-in session; it does not delete the server account. A verified Firebase ID token may be retained in extension storage restricted to trusted extension contexts for up to 45 minutes to restore a session after reload. Server verification is still required; this is not encrypted storage or indefinite sign-in. Logout and authorization rejection clear the restore record. No refresh token is saved by this mechanism.
Payments and licenses
Gumroad handles checkout and payment details. The backend verifies the seller sale, owner, product and supported pack before granting credits. Purchase receipts, disputes and credit recovery are separate from optional analytics. The new recovery handler does not retain or return the submitted raw license key. Do not include a license or token in a public support message.
Optional analytics and local counters
Optional product analytics is off until you opt in. Events contain a random pseudonym, event ID, timestamp and fixed feature/action categories, not inspected code, full URLs, email, credentials or browsing history. Local counters work without sharing. The local unsent queue is limited to seven days and 500 events. Opt-out clears unsent events and attempts to stop an active upload; it cannot recall events already committed. A new opt-in period rotates the pseudonym.
Retention and requests
The analytics release requires configured retention: receipt/participant/daily-active markers are scheduled for 90-day expiry and daily aggregates for 400 days; infrastructure deletion may be delayed. Credit and billing records have separate support, fraud, dispute and recordkeeping needs. Ask for access or deletion review from signed-in Settings or contact support. We review identity, scope, retained records and purchased balances; a request does not silently erase an account or unused purchases. We will explain unresolved scope or retained records rather than claiming an unperformed deletion.
Optional reminders
Email reminders require their own opt-in, independent of analytics. They use your verified email and per-day delivery metadata. Turn them off in Settings or use the scoped unsubscribe link. An already submitted email may still arrive. Provider acceptance is not proof of inbox delivery. Accepted delivery/job records are scheduled for 90-day expiry; uncertain deliveries remain for review.
Optional Runtime Lab and credential checks
Runtime Lab requires a separately installed and authorized companion and reviewed local target. It uses a fresh browser profile, not an operating-system sandbox. The local result may include bounded network destinations/timings, storage key names, WebSocket metadata, message counts and DOM mutation types. Storage values are not requested in controlled native sessions. Response-text previews are off by default; per-run opt-in permits a small bounded preview with basic redaction that can miss secrets. Results are not automatically uploaded to the backend or AI. A credential check sends the selected owned/authorized credential to its named provider only after separate confirmation, using read-only requests. Endpoint acceptance does not establish unrestricted access or billing capacity.
Infrastructure and contact
Hosting, identity, payment, email and AI providers may process operational request metadata such as IP addresses and security logs. We do not sell inspected source or use it for advertising. Extension X-Ray is an independent tool and is not affiliated with Google or inspected extension authors. Contact support for a data request, security report or processing question.