跨域代理助手隐私政策 / Cross-Origin Proxy Privacy Policy

隐私政策（中文）

生效日期 / Last updated: 2026-09-08

1. 我们收集什么

不收集任何用户数据。跨域代理助手是一款本地优先的开发者工具：它没有账号体系，没有服务器端接口，不接入任何统计、埋点、广告或数据分析服务，也不会向开发者控制的任何远程地址发送信息。

2. 数据存放在哪里

代理规则、环境配置快照、请求日志、界面偏好（语言、主题、自动关闭时长）全部保存在你浏览器的 chrome.storage.local 中，仅存在于你的设备。卸载扩展即随之清除。导出功能（JSON 配置、HAR 抓包文件、cURL 命令）只会在你主动点击时把文件写到你本地的下载目录。

3. 为什么需要这些权限

权限	用途
`storage`	在本地保存规则、日志、环境配置与偏好。
`declarativeNetRequest`	安装网络层重定向规则，实现零 JS 开销的简单 URL 重写。
`declarativeNetRequestFeedback`	读取规则命中情况，用于日志面板的命中统计展示。
`alarms`	维持后台脚本存活，并实现代理自动关闭倒计时。
`<all_urls>`	代理需要能在你的任意前端来源（内网域名、localhost、预发环境）上工作，目标环境由你配置、无法事先枚举。该权限只用于按你自己写下的规则转发请求。

4. 请求与响应内容的处理

扩展会在浏览器内部读取被代理请求的 URL、请求头、请求体与响应内容，用于完成你自己配置的转发、改写、Mock 与日志记录。这些内容只在你的设备内处理，不会上传、不会出售、不会用于任何形式的用户画像或广告。日志默认只保留最近 500 条，可在界面中随时清空。

需要如实告知的一点：日志与由它生成的导出文件（HAR、JSON 配置、复制的 cURL）会原样保存这些内容，其中可能包含 Authorization、Cookie 等鉴权头以及请求体里的私密字段。数据仍然只在你手里，但在分享导出文件或截图之前，请先清空日志。

5. 儿童隐私

本扩展是面向开发者的技术工具，不针对儿童，也不会刻意收集 13 岁以下儿童的任何信息。

6. 政策变更与联系方式

若本政策发生变化，会更新页面顶部的生效日期。如有疑问或建议，请在 GitHub Issues 提出，或邮件联系开发者（Better <924902324@qq.com>）。

Privacy Policy (English)

Effective date / Last updated: 2026-09-08

1. What we collect

Nothing. Cross-Origin Proxy is a local-first developer tool. It has no accounts, no server-side endpoints, and no analytics, telemetry or advertising SDKs. It never sends information to the developer or to any remote service we control.

2. Where your data lives

Proxy rules, environment profiles, request logs and interface preferences (language, theme, auto-off duration) are stored in chrome.storage.local on your own device, and are removed when you uninstall the extension. Export actions (JSON configuration, HAR 1.2 capture, cURL command) write files to your local downloads folder only when you trigger them.

3. Why each permission is requested

Permission	Purpose
`storage`	Save rules, logs, profiles and preferences locally.
`declarativeNetRequest`	Install network-layer redirect rules so simple URL rewrites cost no JavaScript per request.
`declarativeNetRequestFeedback`	Read which rules actually matched, for the hit statistics shown in the log panel.
`alarms`	Keep the background worker alive while proxying, and drive the auto-off countdown.
`<all_urls>`	Proxying must work on whatever origin your frontend runs on (internal domains, localhost, staging); target environments are configured by you and cannot be enumerated in advance. The permission is used only to forward requests according to rules you wrote.

4. Handling of request and response content

To perform the forwarding, rewriting, mocking and logging you configure, the extension reads the URL, headers, body and response content of proxied requests inside the browser. This processing stays on your device: the data is not uploaded, not sold, and not used for profiling or advertising. Logs keep the most recent 500 entries by default and can be cleared at any time from the interface.

One thing stated plainly rather than glossed over: the log — and the files generated from it (HAR, JSON configuration, copy-as-cURL) — stores this content verbatim, which can include Authorization and Cookie headers as well as private fields inside request bodies. The data stays in your hands, but clear the log before you share an exported file or a screenshot.

5. Children

This extension is a technical tool for developers, is not directed at children, and does not knowingly collect information from children under 13.

6. Changes and contact

Changes to this policy are reflected in the effective date above. Questions can be raised on GitHub Issues or by emailing the developer (Better <924902324@qq.com>).