Privacy Policy

JSON Formatter & Viewer — Chrome extension and json.fedrr.com. Last updated: 17 October 2026.

1. Scope

This policy covers the JSON Formatter & Viewer Chrome extension and the website json.fedrr.com. Where the two behave differently, the difference is stated explicitly.

2. JSON you work with

Text you paste, type, drop as a file, or load from a URL is parsed, formatted and rendered entirely inside your browser. It is never transmitted to us.

• The current text, the active tab and up to 30 recent states (capped at 5 MB) are saved locally so your work survives closing the popup — in chrome.storage.local in the extension, in localStorage on the website.
• The extension clears the stored JSON, tab and scroll state when the browser starts.
• You can wipe everything at any time with Clear and Clear history, or by removing the extension.
• Load from URL fetches the address you enter. On the website, if the server blocks direct access, the request is retried through the public api.allorigins.win proxy, which means that URL becomes visible to that third party. Only the URL you typed is involved — use a file or paste instead if the address itself is sensitive. Local addresses such as localhost are never sent to the proxy, and the extension never uses it: it requests the URL directly.
• Share link puts your JSON in the URL fragment (#json=…). Fragments are never sent to a web server, so the data stays in the link itself. Anyone you give that link to can read it.

3. WebSocket inspection (extension only)

The extension can show you the WebSocket messages of a page you are working on, formatted as JSON. This feature is off by default and never runs anywhere until you explicitly turn it on for one specific site.

• You grant access per site. On the WebSocket tab you press Allow on this site, and Chrome asks you to confirm access to that one origin. No site is watched before you do this.
• Read-only. Messages are observed as they pass. Nothing is modified, blocked, delayed or injected — neither the traffic of the page nor its content.
• Connection events too. Alongside the messages, the tab notes when a socket opens, closes — with the close code and reason the other side sent — or errors, so a dropped connection is visible instead of looking like silence.
• Stays in the tab. Captured messages live in the memory of that tab only, capped at 500 messages or 5 MB (whichever comes first, oldest dropped). The extension does not write them to disk, sync them, or share them with other tabs — the one way they leave that memory is the export below, which you trigger yourself. Closing or reloading the tab discards them.
• Never transmitted. Message contents are not sent to us or to anyone else, and are not included in any analytics.
• Export goes to you, not to us. The Export button saves the frames you are looking at as a JSON file on your own device. Your browser writes that file locally; it is not uploaded anywhere, and we never see it.
• Revocable. Remove access for a site at any time in chrome://extensions → JSON Formatter & Viewer → Site access. Capture stops immediately.

Please note that WebSocket traffic can contain personal data, session tokens or private messages. That is exactly why access is per-site, opt-in, and local — but only enable it on sites where you are comfortable looking at that traffic yourself.

4. JSON pages in the browser tab (extension only)

The extension can show a JSON document you open in a browser tab — an API response, a .json file on a server — as a tree right in that tab. Automatic formatting is off by default.

• On your click. When you open the popup, the extension checks inside the current tab whether it is a JSON document. Only the result — the page type and size — leaves the tab. The JSON itself is read only when you press Format page or Open in editor. This needs no site access: Chrome lets the extension into the tab you clicked the icon on, until you leave the page. When the formatter is pinned to the side panel, it repeats the same check for the tab you switch to, but only on sites you have given it access to.
• Automatically, on the sites you choose. If you turn on auto-format for a site, or for all sites, Chrome asks you to confirm access first. On those sites a small script looks at the type of every page as it loads. Web pages stop there and are left untouched; JSON and plain-text documents are checked further, and only valid JSON is shown as a tree.
• Separate from WebSocket inspection. Each feature keeps its own list of sites. Turning on auto-format for a site does not start capturing its WebSocket traffic, and the other way round.
• Stays in the tab. The JSON is displayed in the same tab it came from. It is not sent to us or anyone else, not stored, and not shared with other tabs. Copy and Save put it on your clipboard or your disk only when you press them.
• Revocable. Turn auto-format off from the formatted page or from the popup, or remove site access in chrome://extensions → JSON Formatter & Viewer → Site access.

5. Permissions and why they exist

• storage — remember your text, history, theme and active tab between sessions.
• clipboardRead (optional) — asked for the first time you press Paste, so the button can read the clipboard. Copy buttons need no permission.
• scripting — install the WebSocket reader and the JSON page check on the sites you have turned them on for, and only on those; show a JSON page as a tree when you ask for it.
• activeTab — when you open the popup, read the address of the current tab and check whether it is a JSON document, so the extension can offer to format it and knows which site to ask permission for.
• Host access (https://*/*, http://*/*, with http://localhost and http://127.0.0.1 for local development) — declared as optional. Nothing is granted at install time; Chrome grants only the sites you approve, or every site if you choose all sites.

6. What we never do

• We do not collect, store or transmit your JSON or WebSocket data.
• We do not sell or transfer data to third parties.
• We do not use your data for advertising, profiling, or creditworthiness or lending decisions.
• The extension does not load or execute remote code. The website loads only the analytics script described in section 7.
• We do not require an account, and we do not track you across sites.

7. Website analytics

The website json.fedrr.com uses Umami for aggregate visit counts. It sets no cookies and does not build a profile of you. It never receives your JSON. The Chrome extension ships without analytics of any kind — the script is stripped at build time.

8. Children

This is a developer tool and is not directed at children. It collects no personal information from anyone.

9. Changes

If this policy changes, the date at the top is updated. Material changes that affect what the extension does with your data will also be reflected in the Chrome Web Store listing.

10. Contact

Questions about this policy: info@fedrr.com.