HeaderLock Privacy Policy.

The short version

HeaderLock is a Chrome extension that adds, changes or removes HTTP headers on the sites you choose. Your profiles, headers and filters stay in your browser. On the free plan the extension makes no network requests at all. On Pro it checks your licence about once a day. It has no analytics, and it never reads, records or sends the requests, URLs or pages you visit.

What stays on your device

Your profiles, headers, URL filters and variables are stored in your browser (chrome.storage.local). They are never uploaded, synced or shared.

• Chrome applies your header rules itself through its declarativeNetRequest API, so HeaderLock never reads, records or sends the requests, URLs or pages you visit.
• A random install identifier, created on your device, and your licence key if you activate Pro are stored the same way.
• Nothing stored is ever sold, shared, or used for advertising or profiling.

What is sent, and to whom

Free plan: nothing. The extension makes no network requests.

• Pro: when you activate a licence, and about once a day afterwards, the extension sends your licence key and a random install identifier (not linked to your identity) to our licence server at license.tailsgate.com, so it can confirm the licence is valid.
• Nothing about your browsing is sent: no URLs, no headers, no page content.
• The licence server asks Freemius whether the key is valid. The extension itself does not talk to Freemius.

Check it yourself

You don't have to take our word for it. Open chrome://extensions, turn on Developer mode, find HeaderLock and click "service worker". Its Network tab lists every request the extension makes. On the free plan it stays empty.

Uninstall survey

When you uninstall, Chrome opens a short, optional survey page on tailsgate.com. The page address includes the extension version and the random install identifier, and nothing else. Closing the tab sends no answer.

• If you answer: the reason you pick and anything you type in the optional comment box, with that version and identifier.
• Where it goes: our server on Cloudflare Workers, stored in Cloudflare KV.
• Your IP address is not stored. It is hashed so duplicate or abusive submissions can be spotted, and the original address is never kept.

No analytics in the extension

The HeaderLock extension contains no analytics, tracking, advertising or third-party scripts, loads no remote code, and does not record how you use it.

This website

The HeaderLock pages on tailsgate.com count page views and button clicks (for example, which plan was clicked on the Pro page) so we can see whether the pages work. Each visit gets a random identifier kept in your browser for 30 minutes of inactivity. No cookies are used, and no IP address, nothing you type, no licence key and no email is recorded. These counts are stored with Cloudflare Workers Analytics Engine and kept for about three months. The site also loads its fonts from Google Fonts, which, like any web server, sees your IP address when it sends them. The extension itself never contacts Google.

Processors

We use exactly two outside services, only for the purposes above. No other third parties. No analytics, advertising or tracking services.

• Freemius, Inc. — sells Pro and issues licence keys. If you buy Pro, Freemius processes your payment and email under its own privacy policy (freemius.com/privacy). We never see your card details.
• Cloudflare, Inc. — hosts our licence server (a Cloudflare Worker), which receives the licence key and install identifier above, and stores uninstall survey answers and the website page-view counts.

Permissions

HeaderLock asks Chrome for as little as it needs:

• declarativeNetRequest: hands your header rules to Chrome, which applies them itself, so the extension never reads, sees or forwards any request or page.
• storage: saves your profiles, filters, variables and licence key locally in chrome.storage.local. Nothing is synced or uploaded.
• alarms: schedules the once-a-day licence check for Pro. Free users have no key, so the check never runs.
• activeTab: when you open the popup, reads the current tab’s address so it can say whether that page is covered and offer to allow that one site. Nothing is read otherwise.
• Access to sites (optional, not granted at install): Chrome only applies header rules on sites an extension may access, so HeaderLock asks at the moment of use for exactly the hosts in a profile’s URL filters, or all sites only if you choose that.
• Not requested: webRequest, content scripts, or any host access at install.

Your choices

You can export or delete all your profiles from the extension’s settings page at any time, and remove your licence key from the browser there too. Uninstalling the extension deletes everything it stored.

Changes

If what HeaderLock sends ever changes, we will update this page and its date before the change ships.

Contact

Questions about privacy or your data: email [email protected]. To have a licence or survey record deleted, email us from the address you paid with or include your install identifier, and we will remove it.