SSE Tap — Privacy Policy

Last updated: 17 August 2026

SSE Tap is a developer tool for reading the Server-Sent Events a web page receives. This policy describes what it handles and where that data goes.

What the extension collects

While a page is open, SSE Tap records the Server-Sent Event traffic that page receives — event names, event ids, payload contents, connection open, close and error moments, and the URL and title of the tab the stream belongs to. It records this only for tabs that actually carry a text/event-stream response.

Where that data goes

Nowhere. All of it stays inside your own browser, held in memory by the extension's service worker and mirrored into chrome.storage.session so it survives the browser evicting that worker.

• No data is transmitted to the developer or to any third party.
• No data is sent to any server. The extension makes no network requests of its own; it only observes responses the page you are visiting had already requested.
• No data is written to disk. chrome.storage.session is cleared when Chrome closes.
• There is no analytics, telemetry, crash reporting, advertising, or tracking of any kind.

How long it is kept

Captured events are discarded when any of the following happens:

• you close the tab being watched;
• you press Clear in the viewer;
• the buffer reaches its size limit and the oldest records are evicted;
• you quit Chrome, or the extension is removed or reloaded.

Nothing persists across a browser restart.

Data you export yourself

The Export JSON button writes a file to your computer, through Chrome's normal download flow, containing the events currently displayed. That file is yours: the extension neither uploads it nor keeps a copy. If the streams you captured contained personal or confidential data, that data will be in the file, so treat it with the same care as any other debugging artefact.

A note on how capture works

Event records travel from the page's JavaScript context to the extension using window.postMessage. That mechanism is observable by other scripts running on the same page. This is acceptable for debugging an application you control, but it means SSE Tap should not be pointed at a page carrying other people's personal data on an untrusted site.

Permissions

• storage — to hold the event buffer in session storage so it survives the service worker being evicted.
• tabs — to read the title and URL of tabs that have carried an event stream, so the viewer can label them, and to focus an already-open viewer tab instead of opening duplicates.
• Access to all sites — the tap has to be in place before a page's own scripts open their first event stream, so it is injected at document start. Events that fire during application startup are the main case this tool exists to capture. No requests are made to any site.

Children

SSE Tap is a developer tool and is not directed at children.

Changes to this policy

Any change will be published at this same address with an updated date above.

Contact

Questions about this policy: poolodhi@gmail.com