DevBox Privacy Policy

Last updated: July 27, 2026

DevBox is a local-first browser extension. Most of the tools run entirely on your device in the browser and do not require any server-side processing.

Data stored locally

DevBox stores the following locally in your browser using the extension's own storage area, and nowhere else:

• Settings and theme preferences
• Favorite tools and recent tool history
• Snippets you create
• Saved API request collections

These items remain on your device. DevBox does not transmit them to any server for these features.

External network requests

Some features make requests to external services only because you explicitly choose to use them:

• QR code generator — sends the text/URL you enter to a third-party QR rendering API (api.qrserver.com) so it can generate the image.
• API Request Collections tool — sends requests to whatever URL you enter. Because this tool is meant to work with any API you want to test, DevBox requests broad host permissions in the browser to make those requests possible. DevBox itself does not read, log, or forward the content of those requests or responses anywhere — they go directly from your browser to the URL you specified.

Outside of these two tools, DevBox makes no network requests at all.

Pro subscription & payments

DevBox offers an optional paid Pro plan. Checkout, login, and subscription status are handled entirely by our payment processor, ExtensionPay, via pages it hosts itself (extensionpay.com). When you choose to upgrade or manage your subscription, you are taken to ExtensionPay's own payment or login page.

DevBox never sees or stores your payment details. ExtensionPay shares back only your subscription status (Pro or Free) so DevBox can unlock the relevant features locally. Any email address or payment information you provide during checkout is collected and processed by ExtensionPay, not by DevBox. Please refer to ExtensionPay's own privacy policy for details on how it handles that data.

AI features (optional, bring your own key)

DevBox includes optional AI-powered features (such as an AI command agent and "Explain this result" buttons). These features are off by default and only activate once you add your own API key from a provider you choose (currently Anthropic and/or OpenAI) in Settings.

• Your API key is stored only in your browser's local storage (chrome.storage.local). It is never sent to DevBox or to any server DevBox operates — DevBox has no backend server at all.
• AI requests go directly from your browser to the provider you configured (api.anthropic.com or api.openai.com), using your key. DevBox does not proxy, read, log, or store the content of these requests or responses anywhere.
• When you use an AI feature, the specific content you submit (for example, a JSON snippet, a natural-language command, or a tool's output you asked to have explained) is sent to that third-party provider and is subject to that provider's own privacy policy, not DevBox's: Anthropic Privacy Policy · OpenAI Privacy Policy.
• You can remove your API key at any time from Settings, which immediately disables all AI features.

No analytics or telemetry

DevBox does not collect analytics, tracking, or telemetry data of any kind.

Permissions explained

• storage — to save your settings, favorites, recents, and snippets locally.
• clipboardWrite — to support the Copy buttons across tools, including the right-click menu actions.
• contextMenus — to add right-click actions on selected text (e.g. Format JSON, Base64 encode/decode, URL encode/decode, SHA-256 hash).
• notifications — to confirm when a right-click action has completed.
• offscreen — used internally so clipboard copy actions triggered from the right-click menu work correctly in the browser's background process.
• host permissions (all URLs) — required only so the API Request Collections tool can send requests to any API you choose to test.
• host permission (extensionpay.com) — required so the extension can load the ExtensionPay checkout/login pages and receive your subscription status.
• host permissions (api.anthropic.com, api.openai.com) — required only if you enable an optional AI feature, so your browser can send requests directly to the AI provider using your own API key.

Contact

If you have privacy questions, please open an issue on the project's GitHub repository: GitHub Issues.