traceOn — Privacy Policy
Last updated: 7 September 2026
traceOn is a browser extension that records a performance trace of a web page you choose and turns it into a plain-language diagnosis of what is slow and why.
All analysis happens on your device. traceOn works fully with no account and with no network connection to our servers. The only time anything leaves your machine is through the optional features listed in section 2 — every one of them is off by default and can be turned back off at any time in the extension's Community → Privacy & contribution settings.
We do not sell or rent your data, we do not use it for advertising, and we do not use any third-party analytics or tracking SDKs.
1. Data stored only on your device
The following never leaves your browser (it lives in chrome.storage.local):
- Recent performance traces and their analysis results, cached so you can reopen a past analysis.
- Your extension settings and preferences.
- A randomly generated device ID (a UUID created locally). It is not derived from your hardware, your browser, or any account, and it is only ever sent to our server if you enable one of the optional features below.
Clearing the extension's storage or reinstalling it generates a new device ID.
2. Optional features that send data to our server
Our server is hosted on Cloudflare (Workers, D1, Durable Objects, Vectorize).
2.1 Anonymous "active today" ping — off by default
When enabled, once per calendar day the extension sends your random device ID and the current date (UTC). Nothing else. This powers the daily / weekly / monthly active-user counts shown in the Community tab.
2.2 Anonymized scan contributions — off by default
When enabled, after you run an analysis the extension sends:
- the domain only of the analyzed site (e.g.
example.com) — the full URL, path, query string and fragment are removed, and a leadingwww.is stripped; - the date (UTC);
- the numeric scores from that analysis (performance, security, a count of security flags, responsiveness), each 0–100.
Pages that are not public websites (localhost, bare IP addresses, chrome://, file://, other extensions) contribute nothing. Re-scanning the same domain on the same day replaces your previous entry. This powers the "Most Visited" and "Top Lists" views, and it unlocks rating the extension and posting in Community Q&A.
2.3 Extension ratings — you choose to submit each one
If you rate traceOn, we store your star rating (1–5), any review text you write, and your device ID (so you can change your own rating later).
2.4 Community Q&A — you choose to post
If you post a question or answer, the text you write and the display name you choose are stored and shown publicly in the Community tab. Do not include personal or confidential information in a post. You may optionally sign in with GitHub or Google (see section 3); otherwise a post is tied to your device ID.
2.5 AI assistant — you choose to send each question
When you ask the AI assistant about one of your analyses, the extension sends a compressed, already-computed summary of that analysis:
- Core Web Vitals values (LCP, FCP, TTFB, CLS, INP, TBT) and long-task counts;
- the titles and types of the detected bottlenecks;
- the titles and short summaries of the diagnoses and recommendations;
- the detected framework name, if any;
- the URL and capture time of the analyzed page;
- the questions you type and the assistant's replies.
The raw performance trace is never sent. Requests are processed by Cloudflare Workers AI by default. If you explicitly opt in to the paid Anthropic model, the same summary is processed by Anthropic instead. Providers are used in a mode that does not retain the content for training. Your conversations are stored on our server so you can revisit them, and you can delete any conversation from within the extension.
3. Optional sign-in
Signing in is entirely optional and only affects Community Q&A (it lets you post under a persistent name across devices). We use GitHub's or Google's standard OAuth flow. We receive only a provider user ID and your public display name; we never receive your password, and we do not request access to your email, repositories, contacts, or any other data.
4. Rate limiting
To prevent abuse, when your extension makes a write request to our server we briefly combine your device ID with the request's IP address to form a rate-limit key. This is used transiently to count requests in a short time window and is not stored as a profile or used to identify you.
5. Permissions
| Permission | Why |
|---|---|
debugger | Capture the DevTools-Protocol performance trace of the tab you select. You start every recording; the browser shows its own "started debugging" banner. |
activeTab, tabs | Identify the tab under analysis, open the results page, reload the page to capture a cold load, and run the Core Web Vitals measurement script on that page. |
cookies | Read cookie metadata (flags and size, never values) for the analyzed site to report cookie security and size issues. |
storage, unlimitedStorage | Cache traces and results locally; large traces exceed the default quota. |
declarativeNetRequestWithHostAccess | A temporary session rule used only while the Responsive Preview pane is open, so your own page can render in the preview iframe. |
alarms | Schedule the once-daily anonymous ping (only if you enable it). |
nativeMessaging | Optional connection to a separately installed load-testing helper. Unused if the helper is not installed. |
identity | Optional GitHub/Google sign-in for Community Q&A (section 3). |
<all_urls> host access | You can analyze any site you choose; that URL is not known in advance. Access is used only for the tab you actively analyze. |
6. Data retention and deletion
- On-device data: remove it any time by clearing the extension's storage or uninstalling.
- AI conversations: delete individually from within the extension.
- Anonymous ping, scan contributions, ratings, Q&A posts: these are tied to a random device ID, not to you. To request deletion of data associated with your device ID, email the address below with that ID (visible in the extension's Community → Privacy settings).
7. Children
traceOn is a developer tool and is not directed to children under 13.
8. Changes to this policy
We will post any changes on this page and update the "Last updated" date above.
9. Contact
Questions or data requests: solomonmuhye12@gmail.com