Privacy Policy

Effective Date: October 16, 2026
Last Updated: October 16, 2026

This Privacy Policy describes how Vibe Inspect (“we”, “us”, or “our”), an open-source browser extension available on the Chrome Web Store and open-source repositories, handles user data, privacy, and permissions.

We firmly believe that developer privacy and source security are non-negotiable. Vibe Inspect is architected from the ground up with a strict local-first, zero-telemetry design.

---

1. Single Purpose & Philosophy

Vibe Inspect is an open-source developer productivity extension designed to inspect webpage DOM elements and auto-generate clean, token-efficient prompt capsules (~20 tokens) for AI coding assistants (such as Cursor, Claude, ChatGPT, Windsurf, and GitHub Copilot).

We believe in privacy-by-design:

• Zero Data Collection: We collect no personal information, browsing history, telemetry, analytics, or user interaction metrics.
• 100% On-Device Execution: All DOM inspection, box-model computations, framework perception, and prompt generation occur strictly within your local browser runtime.
• Zero Remote Transmission: We do not collect, transmit, store, sell, or share any personal information, browsing history, or inspected webpage data.

---

2. Data Collection and Processing

In strict compliance with the Google Chrome Web Store Developer Program Policies (including Limited Use requirements):

• No Personal Identifiable Information (PII): We never collect, track, or request names, email addresses, IP addresses, browsing habits, session duration, or user accounts.
• No Webpage Content Logging: When you pick an element, all parsing of DOM trees, box models, computed styles, and React/Vue/Svelte/Next.js component metadata happens entirely in your active tab’s volatile memory. Once generated, the text is written solely to your local system clipboard.
• Automatic Password Masking: Vibe Inspect explicitly ignores and desensitizes <input type="password"> elements to guarantee that credentials, sensitive form inputs, or secret tokens are never captured into generated prompts.
• No External Server Transmission: The extension operates without any back-end servers. No analytical requests, telemetry pingbacks, or background transmissions ever take place.

---

3. Local Storage & User Preferences

Vibe Inspect utilizes Chrome’s standard Storage API (chrome.storage.local / chrome.storage.sync) exclusively to remember your localized settings directly on your machine:

• Prompt Formats: Your preferred prompt output format (Pinpoint, Compact, or Detailed).
• Shortcuts Configuration: Your custom keyboard navigation bindings (WASD, Vim arrows, or custom bindings).
• Domain Whitelist Rules: Your user-defined domain whitelist rules (e.g. localhost:3000, custom staging domains). By default, inspection is restricted to localhost and 127.0.0.1.
• UI & Appearance: Your UI theme, HUD display options, and language preferences.

This configuration data stays entirely within your local Chrome profile and is never transmitted to us or any remote third party. You can clear this data at any time via the extension popup or by uninstalling via chrome://extensions.

---

4. Browser Permissions Justification

To fulfill its single purpose while maintaining least-privilege security, Vibe Inspect requests only the following permissions in manifest.json:

Permission	Manifest Field	Purpose & Safety Boundary
Storage	permissions: ["storage"]	Required to persist your local preferences (shortcuts, prompt templates, and domain whitelist) in local browser storage.
Active Tab	permissions: ["activeTab"]	Used on-demand to activate the inspector HUD overlay on the current tab only when you explicitly press the shortcut (Ctrl+Shift+X or Cmd+Shift+X) or click the action button.
Scripting	permissions: ["scripting"]	Injects the local picker runtime into the active tab to calculate element box-models, identify framework markers, and render the isolated inspection HUD.
Clipboard Write	permissions: ["clipboardWrite"]	Used solely to write the generated prompt capsule (~20 tokens) directly to your local system clipboard upon element selection.
Host Permissions	host_permissions: ["<all_urls>"]	Necessary because developers inspect UI components across local development environments (localhost, 127.0.0.1, 192.168.x.x, 172.16.x.x), staging servers, and live web apps. The extension enforces your local whitelist and never transmits page content.

No Background Scraping

Vibe Inspect never scans, monitors, or reads web pages in the background. Content scripts only engage upon explicit user trigger, and HUD UI overlays run in isolated DOM / Shadow DOM boundaries.

---

5. Remote Code & Third-Party Services

• No Remote Code Execution: In full compliance with Manifest V3 security requirements, Vibe Inspect bundles 100% of its scripts, styles, language packs, and icons within the local extension package. It never loads, downloads, or evaluates remote scripts (no eval(), no external CDNs).
• No Analytics SDKs: No tracking SDKs (e.g., Google Analytics, Mixpanel, Sentry, Segment) are bundled or contacted.
• External Links: Optional external links (such as to the GitHub repository) open standard web pages in a new browser tab only upon explicit user click, without injecting or executing remote code inside the extension.

---

6. Security & Vulnerability Disclosure

Vibe Inspect is committed to software security and transparency:

• Isolated HUD Boundary: Interactive HUD and Toast overlays run within isolated Shadow DOM boundaries to prevent CSS/JS interference from host page scripts.
• Reporting Vulnerabilities: If you discover a potential security vulnerability within Vibe Inspect, please report it responsibly:
  • GitHub Private Vulnerability Reporting: Submit via the Security tab on our repository.
  • Security Email: vibeinspect@lave.fun
• Response Timeline: We acknowledge reports within 48 hours and provide a status assessment within 5 business days.

For complete security policy details, see our repository SECURITY.md.

---

7. Open Source Transparency & Contact

Vibe Inspect is released under the permissive MIT License. The source code is completely open for public audit and verification:

• GitHub Repository: https://github.com/Sacilave/vibe-inspect
• Official Documentation: https://vibeinspect.lave.fun
• Email: vibeinspect@lave.fun
• GitHub Issues & Discussions: https://github.com/Sacilave/vibe-inspect/issues