Privacy Policy

Who this applies to

This policy covers the XPath Locator Generator Chrome extension ("the extension"), available on the Chrome Web Store. By installing and using the extension, you agree to the terms described below.

What data we collect

None. The extension does not collect, transmit, sell, or share any personal information, browsing activity, or usage data. There are no fetch requests, XMLHttpRequest calls, WebSocket connections, beacons, or any other form of network communication initiated by this extension. You can verify this by inspecting the source code: search for fetch(, XMLHttpRequest, WebSocket, or sendBeacon across the source files — there will be no matches.

What data is stored on your device

The extension stores three small UI-state values locally using Chrome's chrome.storage.local API. This data is on-device only and is never transmitted, synced to your Google account, or shared with anyone:

You can clear this data at any time from Chrome's settings: go to chrome://extensions, find "XPath Locator Generator," click "Details," then "Site settings" → "Clear data." Uninstalling the extension also removes all stored data.

What we access (only when you ask)

When you click a mode button in the extension's side panel, the extension reads the DOM of the page in your active tab. Specifically, when you click an element, the extension reads:

• The element's tag name, attributes, and visible text
• The element's position in the DOM (ancestors, siblings)
• Other elements on the page (to verify the generated xpath uniquely identifies your target)
• For iframe content, the iframe's URL (so the generated xpath can include driver.switchTo().frame(...) guidance)

All of this happens locally in your browser. The information is used only to compute the xpath that gets displayed in the panel — it is not transmitted anywhere, and it is discarded as soon as the xpath is computed (the only thing saved is the final xpath string itself, in the lastResult storage key above).

The extension does not run on pages you visit unless you explicitly click a mode button. There are no static content scripts in the manifest, so the extension has zero presence on pages you are just browsing.

What we never do

Permissions explained

The extension requests four Chrome permissions:

• <all_urls> (host) — lets the extension inject its content script into your active tab when you click a mode button. Not used to read pages automatically; the extension declares no static content scripts, so when you're just browsing it has zero presence on the page.
• scripting — the standard Manifest V3 API for the on-demand injection described above.
• storage — used only for the three local-only values listed above.
• sidePanel — renders the extension's UI in Chrome's side panel.

The extension does NOT request tabs, cookies, history, bookmarks, webRequest, downloads, notifications, or any other permission that could read data outside of the explicit user-initiated capture flow.

Third parties

The extension uses no third-party services, SDKs, analytics providers, or external code. All functionality is implemented in vanilla JavaScript bundled with the extension. There are no remote scripts, no CDN dependencies, and no auto-updating components that pull code from outside the published extension package.

Children's privacy

The extension is a developer tool. It is not directed at children under 13. As described above, it does not collect data from any user, including children.

Changes to this policy

If the extension's data-handling practices ever change, this policy will be updated, the "Last updated" date at the top will be revised, and the version number in the extension's manifest will be incremented. Material changes will be noted in the extension's changelog.