# Static — Privacy Policy

**Last updated:** August 21, 2026

Static is a Chrome and Firefox extension that blocks websites from fingerprinting which browser extensions you have installed, and blocks known client-side fingerprinting / anti-bot vendor endpoints at the network layer.

This policy describes exactly what information Static processes on your machine, what it does **not** access, and how any data you choose to export is handled.

## The short version

- Static has **no remote server**. There is no account to create; there is nothing to log into.
- Static **never transmits any data anywhere.** No telemetry, no analytics, no crash reporting, no usage stats.
- Static stores a small local record of which extension IDs each website has probed you for. This record lives only in `chrome.storage.local` on your own machine and can be cleared at any time.
- Static has an opt-in QA diagnostics mode for compatibility testing. It stores a bounded local record of recent Static actions and can copy a GitHub issue report with site, extension, and replay-signal labels hashed.
- If Replay poisoning is enabled, Static can redact or perturb event data only for detected session-replay listeners. It does not store form contents and does not send fake traffic.
- If you manually export the log through the log viewer, the file is saved to your computer. Static does not send the export anywhere.

## What Static stores locally

Static stores this local state in your browser profile and never writes to `chrome.storage.sync`, so nothing is synced off your device through Chrome's sync service:

1. **Probe log** — a per-origin map of extension IDs that each site has probed you for, with counts, plus a capped map of the extension-resource pathnames those probes used (for Noise-mode learned-path decoys). Pathnames are extension WAR paths such as `/inpage.js`, never website URLs. Capped at 100 origins × 2,000 IDs per origin × 8 paths per ID; older entries are evicted beyond that cap.
2. **Since-install probe counter** — the total number of extension-enumeration probes blocked since you installed Static.
3. **User secret** — a random 256-bit value generated once, at install time, via `crypto.getRandomValues`. Used only to seed the per-origin decoy personas for Noise mode so that different Static users produce different decoys on the same site. Never displayed anywhere in the UI, never transmitted.
4. **Preferences** — whether Noise mode is enabled, which Replay poisoning mode is selected (`off`, `mask`, `noise`, or `chaos`), and which DNR rulesets (fingerprinting vendors, CAPTCHA vendors) you have turned on. Noise and Replay poisoning preferences are stored in `chrome.storage.local`; DNR ruleset choices are persisted locally by Chrome's extension ruleset API.
5. **Playbook summaries** — weekly, per-origin aggregates describing how a site probed for extensions: probe vectors (for example `fetch`, XHR, Worker, EventSource), coarse extension-resource path kinds (for example manifest, image, script, HTML, CSS, other), per-week ID counts, and first/last-seen times for the weekly bucket. These summaries power local "probe behavior changed" indicators and are capped to the latest 10 weekly buckets per origin.
6. **Replay detection log** — a per-origin summary of likely session-replay SDK signals, such as matching script URLs, known replay globals, Sentry Replay-specific markers, or replay-looking listener sources. Capped at 100 origins × 50 signals per origin. It records signal names/counts and last-seen timestamps, not form values or page content.
7. **Adaptive behavior log** — observe-only, per-origin summaries of correlated local behavior signals that may indicate fingerprinting, replay, or anti-bot collection. It stores category counts, max local score, reason counts, source labels, endpoint origin/path strings, and timestamps. It does not store request bodies, form values, cookies, local storage, or full URLs, and it does not create blocking rules yet.
8. **QA diagnostic log** — only when QA diagnostics mode is enabled, a bounded per-origin trace of recent Static actions for compatibility testing. Capped at 25 origins × 120 events per origin. Probe events store the blocked probe vector, extension-resource path kind/path, and probed extension ID; replay/adaptive events store the same compact metadata Static already uses for local detection. It does not store page content, request bodies, form values, cookies, local storage, or website URL paths.

You can erase the probe log, playbook summaries, replay detection log, adaptive behavior log, QA diagnostic log, since-install counter, and Noise-mode user secret at any time via the **Clear log** button in Static's log viewer. Ruleset, Noise-mode, Replay-poisoning, and QA diagnostics preferences can be changed in the popup; uninstalling Static removes all extension-managed data.

## What Static does NOT store or access

- Page content, form inputs, passwords, cookies, or local storage of any website.
- Full website URLs or your browsing history. The probe log aggregates at the **origin** level (e.g. `https://example.com`). Extension-resource pathnames stored for Noise learning are WAR paths inside `chrome-extension://` IDs (for example `/inpage.js`), never the page URL you visited.
- Your IP address, device fingerprint, or any identifier tied to you personally.
- Any personally identifiable information.

Although Static's content scripts are registered on all URLs (required to intercept extension-fingerprinting probes wherever they occur), the scripts act only on `chrome-extension://` URLs (and equivalents on other browsers) and on a hardcoded list of DOM markers and `window` globals used by fingerprinting code. They do not read, transmit, or otherwise process any other page content.

When Replay poisoning is enabled, Static also proxies event objects delivered to detected replay listeners. That proxy can replace values and keystroke data with redacted placeholders, add small coordinate/geometry jitter, and in Chaos mode deliver local decoy events directly to replay listeners. These event views are not persisted, are not sent by Static, and are not delivered to ordinary page listeners.

## What Static does NOT transmit

Static has no backend. It makes no outbound network requests of its own. It contains no third-party SDKs, analytics frameworks, advertising integrations, crash-reporting services, or telemetry of any kind.

Static's only network-related actions are **blocking** narrow fingerprinting or device-check requests initiated by the websites you visit, and, when Device signal poisoning is enabled, **rewriting** the outgoing `User-Agent` and stripping `Sec-CH-UA` / `Sec-CH-UA-Mobile` / `Sec-CH-UA-Platform` request headers so the network-layer persona matches the JavaScript-layer persona. Both actions happen through Chrome's [`declarativeNetRequest`](https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest) API and through interception of `fetch` / `XMLHttpRequest` calls to extension-scheme URLs. Static does not inspect request bodies, does not ship broad ad-tech / analytics / social-pixel / session-replay network lists, and never originates network requests itself. Replay poisoning and adaptive behavior logging are page-local and do not send fake replay data or adaptive telemetry over the network.

## Permissions Static requests, and why

- **`declarativeNetRequest`** — to block fingerprinting and device-check vendor endpoints at the browser's network layer. Blocking is declarative; Static does not inspect the contents of these requests.
- **`declarativeNetRequestWithHostAccess`** — to install dynamic DNR rules that rewrite outgoing `User-Agent` and strip `Sec-CH-UA` / `Sec-CH-UA-Mobile` / `Sec-CH-UA-Platform` headers when Device signal poisoning is active. This permission is used only for that header-spoofing path; Static does not use it to broadly redirect or inspect traffic.
- **`storage`** — to persist the items listed under "What Static stores locally" above. Uses `chrome.storage.local` only; never `chrome.storage.sync`.
- **Content-script `matches: ["<all_urls>"]`** — to register the API interception on every page, because fingerprinting can happen on any site. Static does not read page content in any origin it runs on.
- **`host_permissions: *://*/*`** — required for the narrow DNR rulesets to match requests to the listed fingerprinting and device-check domains, and for dynamic header rules to attach to outgoing requests. It is the same scope as the content-script match patterns above.

## User-initiated data export

The log viewer offers two export options and one clipboard copy option. Downloads are saved to your computer via the browser's native download mechanism; clipboard copies stay local until you paste them somewhere. Nothing is transmitted by Static.

- **Export raw log** — full fidelity, including per-origin `lastUpdated` timestamps, exact per-ID probe counts, weekly playbook summaries, replay detection summaries, adaptive behavior summaries, and the since-install cumulative counter. Intended for private archival. If you choose to share this file, be aware that timestamps plus exact counts can be correlated with similar dumps from other users to partially re-identify individual browsing patterns.
- **Export for research** — anonymized. Replaces the precise `exportedAt` timestamp with a coarse `exportMonth` (`"YYYY-MM"`), drops per-origin `lastUpdated` timestamps, drops the since-install cumulative counter, coarsens per-ID counts into log-scale buckets (`2-5`, `6-20`, `21-100`, `101-1000`, `1000+`), drops IDs probed fewer than 2 times (canary filter), drops origins with fewer than 3 surviving IDs (low-signal noise filter), replaces origin/extension-ID labels with per-export salted hashes, and omits learned WAR pathnames. The salt is not retained in the file, so labels are not stable across exports.
- **Copy issue report** — anonymized and bounded for GitHub issues. Replaces site origins, extension IDs, and replay-signal labels with per-copy salted hashes, keeps coarse probe vectors/path kinds and recent diagnostic event types, omits local timestamps, omits full site URLs, and does not retain the salt.

Static does not retain a copy of any export or copied issue report. Once the file is downloaded or text is copied, only you have it.

## Third parties

Static shares no data with third parties. Static contains no third-party code or SDKs and integrates with no external services.

## Your rights

Because Static stores data only on your own machine, your rights of access, portability, and erasure are exercised directly through the extension itself:

- **Access**: everything Static has ever recorded about probes against you is visible in the log viewer.
- **Portability**: downloadable as JSON at any time via the **Export** buttons in the log viewer.
- **Erasure**: the **Clear log** button wipes the probe log, replay detection log, adaptive behavior log, and QA diagnostic log, resets the since-install counter, and resets the Noise-mode user secret. Uninstalling Static removes all stored data, including preferences.

No request to the author is required to exercise any of these rights.

## Changes to this policy

If this policy changes, the updated version will be published at the same URL and the "Last updated" date at the top will change. Material changes will also be noted in the project [CHANGELOG](https://github.com/G-man3207/Static/blob/main/CHANGELOG.md).

## Source code and audit

Static is open source under the MIT license. Every behavior described in this policy is verifiable by reading the source code:  
[https://github.com/G-man3207/Static](https://github.com/G-man3207/Static)

## Contact

For privacy or security questions, please open an issue on GitHub:  
[https://github.com/G-man3207/Static/issues](https://github.com/G-man3207/Static/issues)