DepWallExtension privacy policy
What the DepWall browser extension sends, what it never sends, and what it stores. Short, because there is not much of it.
Last updated 2026-08-12 · applies to the DepWall browser extension
What is sent
When you ask about a package — by opening its page, right-clicking it, typing it into the popup, or having it underlined on a site you turned scanning on for — the extension sends three things to DepWall's verdict service:
- the ecosystem,
npmorpip - the package name
- the version, or
latest
That is the whole payload. It is produced by two pure functions,
coords.js and lookup.js, and the extension's tests assert the
shape rather than trusting this description.
What is never sent
- Page contents, page URLs, query strings or fragments
- Your browsing history — no
historyortabspermission is requested - Form data, cookies or credentials — the lookup runs with
credentials: "omit" - Anything about private, internal or unpublished packages you have not asked about
- Any identifier the extension creates to recognise you across requests
What is stored
One optional setting: a custom verdict-service URL, if you set one, held in Chrome's own synced extension storage. Verdicts are cached in memory for six hours and are gone when the browser closes. There is no account, and the extension writes nothing else.
Page scanning
Scanning a page for install commands is off by default and granted per
site. Turning it on asks Chrome for permission for that one site; you can revoke it from
the same switch or from Chrome's own extension settings. The scan reads the page
locally to find npm install … lines — that reading never leaves your
machine, and only the package names it finds are looked up, on the same three-field
payload as everything else.
Who else sees it
Nobody. The verdict service is operated by us, receives only the three fields above, and the request carries no cookie or identifier. Data is not sold, not transferred to third parties, and not used for anything other than answering the lookup. Standard server logs may retain an IP address for abuse and rate-limiting purposes.
Self-hosting
If you would rather not send even that, point the extension at your own deployment in its options. The payload is identical; only the destination changes.
Changes
If what the extension sends ever changes, this page and the extension's own tests change in the same commit. That is the mechanism — the tests fail if the payload grows.