Privacy Policy

JSON Formatter & Viewer — Chrome extension and json.fedrr.com. Last updated: 5 September 2026.

1. Scope

This policy covers the JSON Formatter & Viewer Chrome extension and the website json.fedrr.com. Where the two behave differently, the difference is stated explicitly.

2. JSON you work with

Text you paste, type, drop as a file, or load from a URL is parsed, formatted and rendered entirely inside your browser. It is never transmitted to us.

• The current text, the active tab and up to 30 recent states (capped at 5 MB) are saved locally so your work survives closing the popup — in chrome.storage.local in the extension, in localStorage on the website.
• The extension clears the stored JSON, tab and scroll state when the browser starts.
• You can wipe everything at any time with Clear and Clear history, or by removing the extension.
• Load from URL fetches the address you enter. If the server blocks direct access, the request is retried through the public api.allorigins.win proxy, which means that URL becomes visible to that third party. Only the URL you typed is involved — use a file or paste instead if the address itself is sensitive.
• Share link puts your JSON in the URL fragment (#json=…). Fragments are never sent to a web server, so the data stays in the link itself. Anyone you give that link to can read it.

3. WebSocket inspection (extension only)

The extension can show you the WebSocket messages of a page you are working on, formatted as JSON. This feature is off by default and never runs anywhere until you explicitly turn it on for one specific site.

• You grant access per site. On the WebSocket tab you press Allow on this site, and Chrome asks you to confirm access to that one origin. No site is watched before you do this.
• Read-only. Messages are observed as they pass. Nothing is modified, blocked, delayed or injected — neither the traffic of the page nor its content.
• Connection events too. Alongside the messages, the tab notes when a socket opens, closes — with the close code and reason the other side sent — or errors, so a dropped connection is visible instead of looking like silence.
• Stays in the tab. Captured messages live in the memory of that tab only, capped at 500 messages or 5 MB (whichever comes first, oldest dropped). The extension does not write them to disk, sync them, or share them with other tabs — the one way they leave that memory is the export below, which you trigger yourself. Closing or reloading the tab discards them.
• Never transmitted. Message contents are not sent to us or to anyone else, and are not included in any analytics.
• Export goes to you, not to us. The Export button saves the frames you are looking at as a JSON file on your own device. Your browser writes that file locally; it is not uploaded anywhere, and we never see it.
• Revocable. Remove access for a site at any time in chrome://extensions → JSON Formatter & Viewer → Site access. Capture stops immediately.

Please note that WebSocket traffic can contain personal data, session tokens or private messages. That is exactly why access is per-site, opt-in, and local — but only enable it on sites where you are comfortable looking at that traffic yourself.

4. Permissions and why they exist

• storage — remember your text, history, theme and active tab between sessions.
• clipboardRead / clipboardWrite — the Paste and Copy buttons.
• scripting — install the WebSocket reader on the sites you have granted, and only on those.
• activeTab — read the address of the current tab when you open the popup, so the extension knows which site to ask permission for.
• Host access (https://*/*, plus http://localhost and http://127.0.0.1 for local development) — declared as optional. Nothing is granted at install time; Chrome grants only the individual origins you approve.

5. What we never do

• We do not collect, store or transmit your JSON or WebSocket data.
• We do not sell or transfer data to third parties.
• We do not use your data for advertising, profiling, or creditworthiness or lending decisions.
• We do not load or execute remote code.
• We do not require an account, and we do not track you across sites.

6. Website analytics

The website json.fedrr.com uses Umami for aggregate visit counts. It sets no cookies and does not build a profile of you. It never receives your JSON. The Chrome extension ships without analytics of any kind — the script is stripped at build time.

7. Children

This is a developer tool and is not directed at children. It collects no personal information from anyone.

8. Changes

If this policy changes, the date at the top is updated. Material changes that affect what the extension does with your data will also be reflected in the Chrome Web Store listing.

9. Contact

Questions about this policy: info@fedrr.com.