Privacy Policy for Zustand DevTools

Zustand DevTools does not send your application state, trace contents, browsing history, or other website content to the developer or to anyone else. There is no analytics and no telemetry. The extension processes state locally to display it in your own Chrome DevTools panel.

What the extension processes

The extension reads component and store state from pages you inspect while Chrome DevTools is open with the "Zustand" panel active, and displays it in that same panel. That state is relayed entirely through the browser's own internal extension messaging, from the inspected page to your own open DevTools window, and is not sent off your device.

What is stored, and where

• Recent Trace Sessions, the free-preview counter, and the license record are stored in the extension's local browser storage (chrome.storage.local) so they survive DevTools restarts. Saved sessions are always view-only.
• The bridge's action history (zustand-devtools-bridge) is a bounded, per-tab buffer kept in the inspected page's own sessionStorage, so a reload doesn't wipe your timeline. It follows the browser's normal tab and session lifetime.
• Trace files you export are ordinary local files saved by your browser. They remain wherever you saved them until you delete them.

Licence activation (the only network use)

If you paste a licence key into the Trace Sessions tab, tick the disclosure and choose Activate, Chrome asks for optional access to api.gumroad.com. The extension sends the key, this product's public ID and a use-count flag to Gumroad's licence verification API. The accepted key, product ID, use count and verification timestamps are stored locally so you do not have to re-enter the key.

An active licence is re-checked after 30 days without incrementing its use count. Removing the saved licence also removes the optional Gumroad permission. Application state, trace contents, browsing history and payment details are never included in these requests. Payment happens on Gumroad's checkout page, outside the extension.

Third-party services

Gumroad (api.gumroad.com) receives the licensing fields described above when you activate or revalidate a licence, and processes purchases on its own site. See Gumroad's privacy policy for how it handles that data. No other third party receives anything. The developer operates no server: apart from the licensing requests you trigger, nothing leaves your machine.

Trace session files (export and import)

The Pro tier can export a trace session file at your explicit request. That file is created locally and saved by your browser; the extension never uploads it. Trace files can contain application state, source file paths, and your own notes. The extension warns before export and offers a metadata-only export, and the bridge redacts common sensitive keys plus any patterns you configure, but you should review a file before sharing it. Importing is local too: imported files are schema-validated, size-limited, opened view-only, never executed, and never injected into the inspected page.

Retention and deletion

• Uninstalling the extension clears everything it keeps in Chrome's extension storage: saved Trace Sessions, the preview counter, and the license record.
• Uninstalling does not delete trace files you exported; delete those like any other file.
• The bridge's history in an inspected page's sessionStorage follows that tab or session's lifetime and is cleared by the browser when it ends.

Changes to this policy

If what this extension stores or transmits ever changes, this page will be updated and the "Last updated" date above will change accordingly.

Contact

Open an issue on the project's GitHub repository, or email kuba.opoczka@gmail.com.