Kode Injector Privacy Policy

Information processed by the extension

Kode Injector processes the following information locally on the user’s device:

• Injection rules created by the user, including website hostnames, local file paths, per-file state, and enable or disable settings.
• The URL and hostname of an open browser tab, so the extension can determine which user-created rules apply and display the matching state in its popup.
• The contents of local JavaScript and CSS files explicitly selected by the user. The extension reads those files only to apply the configured rule to a matching website.
• Interface preferences such as language, theme, and local-file access method.

These values are application data required to provide the extension’s single purpose. They are not used for advertising, profiling, or analytics.

Storage and transmission

Rules and preferences are stored in the browser’s local extension storage. Kode Injector does not operate a server and does not transmit rules, browsing activity, local file paths, or local file contents to the developer or an analytics service.

In Chrome and Microsoft Edge, local files are read through browser-managed file-URL access by default. If the user explicitly selects the optional Native Host method, Kode Injector Helper reads only the exact local regular file path requested by the extension. The Helper is read-only: it cannot write files, list directories, execute programs, start subprocesses, or access the network.

In Safari for macOS, the same read-only Go reader is embedded inside the Safari extension. macOS displays its standard folder authorization panel when the user adds or saves a rule whose immediate containing folder has not yet been authorized. The native extension stores a read-only security-scoped bookmark for that folder in local preferences. Bookmark data, file paths, and file contents are not logged or transmitted by the native bridge.

The Safari native bridge may keep up to two file snapshots totaling 10 MiB in memory for 30 seconds. The WebExtension can also keep up to 64 last-known-good rule snapshots totaling 10 MiB in memory, with no fixed lifetime, so it can inject promptly while refreshing files for a future page load. Neither cache is written to disk, and both disappear when their processes stop. Removing the containing application prevents further use of grants; clearing its local application data also removes stored bookmarks.

When a rule matches, the user-selected JavaScript or CSS is applied to that website in the browser. CSS is inserted into the page DOM, JavaScript runs in the page’s main world, and injected JavaScript logs its configured local file URL in that page’s console for diagnostics. The website can process or transmit information available to its page under its own privacy policy. Users should configure only code and websites they trust.

Links to GitHub Releases, documentation, or support open only after a user action. Those sites process requests under their own privacy policies.

Sharing and sale

Kode Injector does not sell personal information. It does not share personal information with the developer, advertisers, data brokers, or other third parties, except for the user-directed disclosure of selected source code and the JavaScript file URL to the website configured for that rule as described above.

Retention and deletion

Rules and preferences remain in local browser storage until the user deletes them, clears the extension’s data, or uninstalls the extension. The developer does not hold a server-side copy.

Children

Kode Injector is a developer tool and is not directed to children. It does not knowingly collect personal information from children.

Changes to this policy

Material changes will be published on this page and in the public source repository with a new effective date. The repository’s version history records previous revisions.

Contact

Questions or privacy requests can be sent to me@maximtop.dev or filed through GitHub Issues.