DevBox Privacy Policy

Last updated: July 26, 2026

DevBox is a local-first browser extension. Most of the tools run entirely on your device in the browser and do not require any server-side processing.

Data stored locally

DevBox stores the following locally in your browser using the extension's own storage area, and nowhere else:

• Settings and theme preferences
• Favorite tools and recent tool history
• Snippets you create
• Saved API request collections

These items remain on your device. DevBox does not transmit them to any server for these features.

External network requests

Some features make requests to external services only because you explicitly choose to use them:

• QR code generator — sends the text/URL you enter to a third-party QR rendering API (api.qrserver.com) so it can generate the image.
• API Request Collections tool — sends requests to whatever URL you enter. Because this tool is meant to work with any API you want to test, DevBox requests broad host permissions in the browser to make those requests possible. DevBox itself does not read, log, or forward the content of those requests or responses anywhere — they go directly from your browser to the URL you specified.

Outside of these two tools, DevBox makes no network requests at all.

Pro subscription & payments

DevBox offers an optional paid Pro plan. Checkout, login, and subscription status are handled entirely by our payment processor, ExtensionPay, via pages it hosts itself (extensionpay.com). When you choose to upgrade or manage your subscription, you are taken to ExtensionPay's own payment or login page.

DevBox never sees or stores your payment details. ExtensionPay shares back only your subscription status (Pro or Free) so DevBox can unlock the relevant features locally. Any email address or payment information you provide during checkout is collected and processed by ExtensionPay, not by DevBox. Please refer to ExtensionPay's own privacy policy for details on how it handles that data.

No analytics or telemetry

DevBox does not collect analytics, tracking, or telemetry data of any kind.

Permissions explained

• storage — to save your settings, favorites, recents, and snippets locally.
• clipboardWrite — to support the Copy buttons across tools, including the right-click menu actions.
• contextMenus — to add right-click actions on selected text (e.g. Format JSON, Base64 encode/decode, URL encode/decode, SHA-256 hash).
• notifications — to confirm when a right-click action has completed.
• offscreen — used internally so clipboard copy actions triggered from the right-click menu work correctly in the browser's background process.
• host permissions (all URLs) — required only so the API Request Collections tool can send requests to any API you choose to test.
• host permission (extensionpay.com) — required so the extension can load the ExtensionPay checkout/login pages and receive your subscription status.

Contact

If you have privacy questions, please open an issue on the project's GitHub repository: GitHub Issues.