Privacy Policy

Last updated: 2026-06-10  ·  Applies to version 2.1.0 and later

1. Developer

Atool is an independent open-source project maintained by a solo developer.

Contact: kary372022@gmail.com

2. Data We Collect

None.

• Atool intercepts and displays WebSocket messages locally inside your browser.
• All message data exists only in browser memory for the lifetime of the panel.
• There is no backend server receiving any data from the extension.
• There is no analytics, crash reporting, or telemetry.

3. Data Stored Locally

Data	Purpose	Where
WebSocket URLs, frames, direction	Displayed in the panel in real time	Browser memory only — cleared when panel closes
Subscription rules, send templates	Restored when you reopen the panel	Browser localStorage (your device only, no permission required)
Input of the SQL / JSON / Time / QR / Diff tools	Computed live by the tool	Browser memory only (not persisted)

4. Third-Party Requests

Atool makes exactly one kind of third-party request:

• ⚠ The "SQL Generator" multi-language translation: when you use this tool, the source text you type is sent to Google Translate's public endpoint (translate.googleapis.com) to fetch translations. This is required for that feature to work.
• If you do not use the SQL Generator, the extension makes no outbound third-party requests.
• Everything else — WebSocket capture / decode / diagnostics / send, and the QR / JSON / Time / Diff tools — is computed locally with no network access. No CDNs, fonts, tracking pixels, or error-reporting services.

When you use "New Connection", the extension opens a WebSocket to an address you type — your own request to your own target; the extension does not route or log it externally.

5. When Data Leaves the Browser

Aside from the translation request above, captured data leaves the browser only when you explicitly click "Export JSON", which writes the current message log to your local Downloads folder.

6. Permissions Explained

Permission	Reason
sidePanel	Show the tool panel in the browser's side panel
Host: https://translate.googleapis.com/*	Only for the SQL Generator's multi-language translation (see §4)
Content scripts on <all_urls>	Users debug WebSocket on arbitrary sites; the domain can't be predicted, used to inject the capture script

Settings are saved via standard localStorage (no storage permission); the side panel reads only the tab ID (a non-sensitive field, no tabs permission).

Permissions not used: storage, tabs, webRequest, cookies, history, identity, remote code execution.

7. Children

Atool is a developer tool not directed at children. It does not knowingly collect data from anyone.

8. Open Source

The complete source code is available at github.com/kary2999/atool. Anyone can audit exactly what the extension does.

9. Changes to This Policy

If future versions require any new data handling, this document will be updated and the change will be noted in the extension's release notes.

10. Contact

Privacy questions or vulnerability reports: kary372022@gmail.com