Applies to the ProperHeader browser extension, version 1.0 and later. Last updated: 3 November 2026.
ProperHeader is made by RJ Macarthy, a sole trader in the United Kingdom, who is the data controller for the limited data described here. Contact: richardmacarthy@protonmail.com.
ProperHeader changes requests according to rules you write: it sets or removes headers, redirects or blocks requests, and replaces files. It uses Chrome's declarativeNetRequest API, so Chrome applies the rules itself, and only on sites you have given the extension access to. The extension does not read, record, store or transmit the pages you visit, their content or your browsing history.
If you use CSS injection, a small script runs on matching pages. It only asks the extension to insert your CSS into that page and reads nothing from the page. If you use JavaScript injection, your own code runs on the pages you choose. Chrome requires you to turn this on explicitly with its "Allow User Scripts" setting.
| Data | Where | Why |
|---|---|---|
| Your profiles and rules (headers, filters, redirects, overrides, injections), pause state | chrome.storage.local on your computer | To apply your rules |
| A copy of your profiles, only if you turn on Sync (off by default) | chrome.storage.sync, which Chrome syncs through your Google account to your other signed-in browsers | To keep your rules the same on all your computers. Google's handling of Chrome sync data is covered by Google's privacy policy. |
| Licence status (free/pro, plan type, when it was last checked) | chrome.storage.local | To unlock Pro features |
| ExtensionPay's random account key, cached licence data and an install date. These are written only after you click Upgrade or Restore purchase. | chrome.storage.sync (set by ExtensionPay's library) | So that a purchase works on all your signed-in browsers |
Uninstalling the extension deletes its local data. Turn off Sync before uninstalling if you also want the synced copy removed, or clear it through your Google account's Chrome sync settings.
The extension's own pages run under a Content-Security-Policy that lets them connect only to https://extensionpay.com, so Chrome itself blocks any other connection. The complete list:
| When | Request | What is sent |
|---|---|---|
| You click Upgrade or Restore purchase for the first time | POST https://extensionpay.com/extension/<id>/api/new-key | Whether this is a developer (unpacked) install. The response is a new random account key. |
| After that: at most once a day (checked when you open the popup or settings, and at browser start-up); and about every 15 seconds while the settings page is open during a purchase or restore you started, for up to 30 minutes | GET https://extensionpay.com/extension/<id>/api/v2/user?api_key=<key> | The random account key. The response says whether you have paid and which plan you have. |
| You click Upgrade or Restore purchase | Opens extensionpay.com/extension/<id>/choose-plan or /reactivate in a normal browser tab | The random account key, in the page URL |
Like any web request, these also reveal your IP address and browser user-agent to ExtensionPay. No other data, including your rules, the sites you visit and page content, is ever sent.
Pro is sold through ExtensionPay, which processes payments with Stripe. You enter your email and payment details on their pages, not in the extension. I never see your card details. ExtensionPay gives me your email address, your plan and your payment status, so that I can provide support and handle refunds. I use your email only for that and never for marketing unless you ask. I keep these records for as long as UK tax law requires.
If you enter your email on properheader.com to be told when ProperHeader is available, I store that email address, the time you signed up and your IP address (used only to stop abuse) on my own server. A notification of the signup is sent to me through the email service Resend. I use your address to send you one email when ProperHeader is live, and nothing else. I don't share it, and I delete the list once the launch email has gone out. Email me at the address above to be removed sooner. The extension itself never collects your email.
If you use the support form on properheader.com, your name (if you give it), email address, topic and message are emailed to me through Resend so that I can reply. Your IP address is checked briefly in memory to stop spam and is not stored. I keep support emails only as long as needed to help you and handle any follow-up.
Under UK GDPR you can ask to see, correct or delete the personal data I hold, which is only purchase records and, if you signed up, your launch-list email and any support emails you send. Write to the contact address above. You can also complain to the Information Commissioner's Office (ico.org.uk).
If this policy changes, the new version will be posted at this address with a new date. Any change that adds a network request or new data collection will also be listed in the extension's release notes.