Privacy Policy for Event Watcher

Overview

Event Watcher is a browser developer tools extension that helps developers debug analytics implementations. This privacy policy explains how the extension handles data, including the optional AI features introduced in version 1.1.0.

Data Collection

Anonymous Usage Analytics

Event Watcher collects anonymous usage analytics to help improve the extension. We use Amplitude (EU data residency) to track:

• Extension open/close events
• Feature usage (which filters are used, view modes, settings changes, etc.)
• App version and platform
• Resolved theme (light/dark) and browser/OS metadata
• AI feature usage meta — provider (Anthropic / OpenAI / Gemini), success or error category, input/output token counts, the selected task preset, and a bucketed length of any free-form question (short / medium / long) — but never the prompt content, the AI's response text, or any captured event data. This follows the same opt-out toggle as every other analytics event.

What we DO NOT collect:

• No personal information (name, email, etc.) outside of explicit feedback form submissions
• No URLs of sites you visit
• No website content or tracking data you're debugging
• No IP addresses (Amplitude EU is configured without IP tracking)
• No API keys, AI prompt text, or AI response text — even when AI features are in use

How It Works

• A random device ID is generated locally (not linked to your identity)
• No cookies are used
• No user accounts or login required
• Data is sent to Amplitude's EU servers

Opt-Out

You can disable analytics in the extension settings (Settings → Privacy). When disabled, no data is sent to Amplitude.

Unknown Tool Detection

When Share unknown tracker hostnamesis on (the default), the extension includes hostnames of unrecognised trackers on its page-load analytics events to help grow built-in detection. Only the hostname is shared — never the path, request data, or page URL — and any hostname sharing a root domain with the site you're on is dropped first. You can turn this off in Settings → Privacy.

Feedback Form Submissions

If you use the in-product Feedback form to send a bug report, feature request, missing-tool report, or wrong-consent flag, the fields you fill in (subject, comment, optional name, optional email, optional website URL, optional endpoint pattern) are sent to Amplitude as part of the analytics event so we can act on them. This is opt-in per submission and is the only place free-text input is collected.

AI Features (Optional, Bring Your Own Key) — v1.1.0+

Event Watcher includes optional AI features that you enable by providing your own API key for one of:

• Anthropic Claude — https://api.anthropic.com
• OpenAI — https://api.openai.com
• Google Gemini — https://generativelanguage.googleapis.com

When you enable AI features and trigger an action (e.g., AI Summary on an event, AI Chat across a session, Auto-identify Unknown Platform), the extension sends data directly from your browser to the AI provider you selected. There is no Event Watcher proxy or server in the path; you pay the provider directly under their terms.

What is sent to the AI provider

• The parsed event payload and request context for the selected event
• For AI Chat: a one-time snapshot of the captured events in the current session, then only the chat history on follow-ups
• For page-scoped chats: events captured between two page navigations
• For GTM Container AI: tag, variable, trigger, and event-group structure parsed from the GTM container response
• Any user-typed comments attached to the event so the AI can reason about them

What is NOT sent to the AI provider

• Your API key is sent only as the standard authentication header to the provider you chose
• Cookies, browsing history, page DOM content, or anything outside the captured tracking data
• Data from other tabs or sessions

PII redaction. Settings → Features → Redact PII in AI prompts is on by default. When enabled, a regex pass in the extension service worker scrubs common PII patterns (emails, phone numbers, IP addresses, etc.) from prompts before they leave the browser.

Disabling AI entirely. Settings → Features → Show AI features hides every AI surface. With it off, no AI calls are ever made.

Where API Keys and AI History Are Stored

• API keys are stored locally in chrome.storage.local under ai_config. They never sync to other browsers or devices, are never sent to Event Watcher servers, and are never included in analytics. Removing a key from the Provider tab wipes it immediately.
• AI usage history (token counts, daily request counts, recent error states) is stored locally and capped to a 30-day rolling window.
• AI chat history is stored locally with a Least-Recently-Used cap of 5 conversations. Older conversations are dropped automatically.

What the Extension Does Locally

• Monitors network requests on the current tab to detect analytics tracking calls
• Parses tracking data locally in your browser for display in the DevTools panel
• Stores your filter preferences, settings, AI configuration, and other state locally using Chrome's chrome.storage.local API
• GTM Hub: Can optionally rewrite or block specific GTM container requests via declarativeNetRequest rules you create (Block / Swap / Preview). Rules are scoped to a domain, apply only to your local browser session, and persist until you remove them
• Consent Monitoring:Detects Consent Management Platforms (CMPs) on the page and reads their consent state to check whether tracking events comply with the user's consent choices. No consent data is collected or transmitted
• Custom Endpoints: Allows you to define custom domain-to-tool mappings so the extension can recognize 1st-party proxies and CNAME-cloaked tracking endpoints. These mappings are stored locally in your browser
• Cookie Monitoring: Reads cookies set by detected tracking platforms on the current page for display in the DevTools panel. Cookie data is processed locally and never transmitted

Permissions Explained

The extension requires the following permissions:

The connect-src directive in the extension's content security policy allows network requests to:

• https://api.eu.amplitude.com (anonymous usage analytics, opt-out available)
• https://api.anthropic.com (only if you configure an Anthropic API key)
• https://api.openai.com (only if you configure an OpenAI API key)
• https://generativelanguage.googleapis.com (only if you configure a Google Gemini API key)

If you do not configure an AI provider, no requests are ever made to the three AI endpoints.

Data Storage

• Session Data: Captured events are stored in memory and cleared when you close the DevTools panel or navigate to a new page
• Preferences: Filter settings, defaults, and analytics opt-out preference are stored locally using chrome.storage.local
• AI Configuration: API keys, selected provider/model, and feature toggles are stored locally under ai_config
• AI Usage History: Token counts and daily request counts are stored locally with a 30-day rolling window
• AI Chat History: Up to 5 most-recent conversations stored locally; older entries are dropped automatically
• GTM Hub Rules:Container block, swap, and preview rules are stored locally per domain using Chrome's storage API
• Custom Endpoints: Custom domain-to-tool mappings are stored locally in your browser and do not sync across devices
• Analytics: Anonymous usage data is sent to Amplitude (EU) unless you opt out

Third-Party Providers

When you opt in to AI features, your data flows directly to the third-party provider you choose. Their privacy policies and data handling terms apply:

• Anthropic: anthropic.com/legal/privacy
• OpenAI: openai.com/policies/privacy-policy
• Google: policies.google.com/privacy

Event Watcher does not retain, log, or proxy any AI request or response.

Contact

For questions about this privacy policy or the extension:

• Author: Rune Andersen