Statable Logo

Statable Debugger Privacy Policy

Last updated: August 10, 2026

This privacy policy explains how the Statable Debugger browser extension ("the extension") handles information. Statable Debugger is a developer tool published by Key Arg B.V. for Chrome and Firefox. We are committed to the same privacy-first approach as our analytics service: all processing described below happens locally in your browser, the extension makes no network requests of its own, and the information it reads never leaves your device.

Both browser builds read the same information and handle it the same way, so this policy applies to each of them. Where they differ, the difference is noted. The extension opens in the side panel on Chrome and in the sidebar on Firefox; this policy calls that surface "the panel".

1. Who We Are

Statable Debugger is developed and published by Key Arg B.V., a company registered in the Netherlands, and Key Arg B.V. is responsible for it. Because the extension transmits nothing, we never receive, store or decide what happens to anything it reads: that processing takes place on your device, under your control, and ends there. Key Arg B.V. is a data controller only for personal data you send us directly — an email to the address below, for instance — and for the statable.com website and analytics service. This policy is governed by the laws of the Netherlands. You can contact us at support@statable.com. Full company contact details are available in our main Privacy Policy.

2. Single Purpose

Statable Debugger has one purpose: it is a developer tool that checks whether the Statable analytics script is correctly installed on the page you are viewing, shows its configuration and warnings, and displays a live log of the analytics events that page sends. Documentation is available at https://statable.com/docs/debugger/.

3. Scope Of This Policy

This policy covers the Statable Debugger extension only. The Statable analytics service itself — the script that website owners install on their sites and the visitor data it processes — is covered by our main Privacy Policy. If you use both the extension and the service, please read both policies.

4. Information The Extension Reads

The extension's content script runs automatically on the http and https pages you visit. This is what allows it to detect the Statable script and observe analytics events as they happen. Everything it reads is processed locally on your device, and the results are shown only when you open the panel. Because the extension observes pages you browse and the analytics requests they send, our Chrome Web Store privacy disclosure declares "Web history" and "User activity"; this section describes exactly what that means in practice. The Firefox build declares no data collection at all to Mozilla, because nothing it reads is ever transmitted off your device.

On each page, the extension reads:

  • Statable script tags only: it scans the page's script elements for ones whose src matches Statable's script URLs and reads their attributes (src, data-id, data-hash, data-tracking-api, data-before-send and data-statable-* attributes). Other scripts are passed over and nothing else on the page is read;
  • environment signals relevant to analytics: the page hostname, browser automation flags (navigator.webdriver and the presence of window.Cypress), and your Global Privacy Control and Do Not Track settings;
  • one localStorage key of the page, 'analytics_ignore', which is read-only — the extension never writes to a site's storage;
  • tracker presence, as a simple yes/no check for whether the tracker's load flag (window.__statableCodeLoaded, or window.__statableTrackerLoaded in older tracker versions) and window.statable exist on the page; and
  • outgoing analytics events: when a page loads, the content script wraps the page's window.fetch function. It inspects only plain-string JSON request bodies and treats a request as a Statable event only if its URL contains '/api/event' or its payload matches the Statable event shape (a numeric v, string n and numeric i field). The original request always proceeds unchanged, and requests sent via XMLHttpRequest or sendBeacon are not intercepted.

When you open the panel, the extension additionally reads the id and URL of the active tab; the URL is used only to check whether the page is an http or https page.

5. How Each Type Of Information Is Used

Each type of information serves exactly one feature, and nothing else:

  • Statable script tag attributes power the detection result and the configuration card, and are checked for misconfigurations to generate warnings;
  • environment signals and the 'analytics_ignore' key are used only to generate warnings that explain why tracking may be inactive on the page;
  • the tracker presence check feeds the installation status shown in the panel;
  • intercepted analytics events populate the live event log; and
  • the active tab's id and URL are used to show you the results for the tab you are looking at and to confirm the page is an http or https page.

We do not use any of this information for any other purpose.

6. Information We Do Not Collect

The extension does not read or collect:

  • cookies;
  • form contents or keystrokes;
  • page text, headings or any other page content beyond the Statable script tags described above;
  • any log or list of the pages you visit — the extension never builds or retains a browsing history, and only reads the current page's hostname in the moment, as described in section 4; and
  • login credentials, passwords or payment information.

7. Sharing And Disclosure

The extension transmits nothing. It makes no network requests of its own: there is no telemetry, no crash reporting, no usage analytics, no accounts and no cookies. The information described in this policy never leaves your browser. As a result:

  • we do not sell user data;
  • we do not transfer user data to third parties;
  • we do not use or transfer user data for advertising of any kind, including personalized or interest-based advertising;
  • we do not use or transfer user data to determine creditworthiness or for lending purposes; and
  • no human — at Key Arg B.V. or anywhere else — can access the data, because it is never transmitted anywhere.

Nothing is sent anywhere unless you click. The one exception is the "Open dashboard" link in the panel: clicking it opens that site's dashboard on statable.com in a normal browser tab, the same as typing the address yourself. Your use of the Statable website is governed by our main Privacy Policy.

8. Store Policies

Chrome. Statable Debugger's use of information received from browser APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The information is used only to provide the single, user-facing purpose described in this policy; it is not transferred, sold or used for advertising, and no humans read it.

Firefox. The extension transmits no data, so Mozilla's data collection and transmission requirements are satisfied by design: the manifest declares no data collection, Firefox states that at install, and there is no consent step to present because there is nothing to consent to.

9. Data Retention

Nothing is persisted. The extension does not write any data to disk or to any form of persistent browser storage. All state is held in memory inside the extension's background context — a service worker on Chrome, an event page on Firefox, which has no Manifest V3 service workers — separately for each tab, as one detection result plus a list of at most 100 events per tab (the oldest events are dropped first); the panel displays the most recent 50. This in-memory state is erased:

  • when you navigate the tab to a new page (unless the “Preserve” toggle in the Events header is on, which keeps the tab's in-memory event log across in-page navigations until that background context is shut down or the tab is closed; it is off by default);
  • when you close the tab;
  • when that background context goes idle (Chrome shuts its service worker down after roughly 30 seconds of inactivity; Firefox unloads the event page on its own idle timer); and
  • when you restart the browser.

10. Data Security

The strongest security measure is architectural: the extension never transmits data over the network, so there is no data in transit to protect. The requirement to encrypt personal data in transit is satisfied trivially, as no transmission occurs at all. All processing takes place inside your browser on your own device, and the information is discarded as described in section 9.

11. Remote Code

The extension does not download or execute remote code. It is built on Manifest V3, and all of its code is bundled into the extension package reviewed by the Chrome Web Store and by Mozilla Add-ons.

12. Changes To This Policy

If we change what the extension reads, how that information is used, or any other data practice described here, we will update this policy, revise the "Last updated" date above, and proactively notify users of material changes through the extension's Chrome Web Store and Firefox Add-ons listings before the new practices take effect.

13. Contact Us

If you have questions about this policy or the extension's data practices, contact us at support@statable.com. Full company contact details, including our postal address, are available in our main Privacy Policy.