API to Postman
← Back to Overview Chrome Web Store ↗
Chrome Web Store Policy Compliant Effective Date: October 9, 2026 • Version 0.1.1

Privacy Policy

Transparency is central to how we build. API to Postman is designed to operate locally inside your browser DevTools without remote tracking, telemetry, or external monetization.

💻

100% Client-Side Processing

All network inspection and Postman collection generation takes place strictly in memory on your local machine.

🚫

Zero Telemetry & Tracking

No Google Analytics, no telemetry pings, no advertising SDKs, and zero tracking cookies. We do not track what you capture.

🔒

Automatic Redaction

Sensitive headers like Authorization and cookies are converted into Postman template variables prior to export.

🌐

Direct Postman API Only

The extension communicates externally solely with api.postman.com when you voluntarily publish a collection.

01. Single Purpose Statement

API to Postman is a developer productivity browser extension. Its single, explicit purpose is to enable web developers, QA engineers, and security researchers to inspect HTTP/HTTPS network traffic initiated in their Chrome DevTools session and export selected requests into standard Postman Collection (v2.1) JSON format or publish them to a designated Postman workspace.

The extension does not serve advertisements, monetize user data, profile user behavior, perform background page scanning, or modify webpage DOM content.

02. Types of Data Handled

In fulfilling its single purpose, the extension temporarily interacts with the following categories of data:

  • Network Traffic Data: URLs, HTTP request methods (GET, POST, etc.), query parameters, request headers, request payloads/bodies, response status codes, response headers, and response size metrics.
  • User Configuration Settings: Optional Postman Personal Access Key (API Key), Postman Workspace ID, and preferred default collection name.
  • UI Filter State: Local filters applied during inspection (method filter, status filter, search strings).
No Personal Identification or Surreptitious Logging

The extension does NOT collect your IP address, device fingerprints, browsing history outside of inspected tabs, or any biometric/personal demographic data.

03. Browser Permissions Justification

In accordance with Google Chrome Web Store Developer Program Policies, the extension requests only the minimum necessary permissions required to fulfill its functionality:

Permission Scope Justification
debugger Chrome DevTools Protocol (CDP) Required to attach to the Network domain of the active tab. This is the official Chrome API mechanism allowing the extension to capture accurate request bodies, query parameters, and headers directly from browser interactions. Capture only runs when explicitly activated by clicking "Start capture".
storage Local Storage (chrome.storage.local) Allows the extension to remember your Postman Workspace ID, default collection name, and optional API key on your local device so you do not need to re-enter them between browser restarts.
https://api.postman.com/* Host Permission Required strictly to make authenticated HTTPS requests to Postman's official REST API endpoint (https://api.postman.com/collections) when the user clicks the "Create collection in Postman" button.

04. Data Sharing, Transmission & Third Parties

We adhere strictly to the principle of zero data leakage:

  • No Developer Server: The creators of API to Postman do not operate any analytics server, database, or logging endpoints. Your captured data never reaches our servers because we do not have one.
  • No Third-Party Brokers or Advertisers: We never sell, rent, license, or exchange user data with data brokers, advertisers, tracking firms, or commercial partners.
  • Postman API Communication: If and only if you explicitly choose to export your collection directly to Postman using the "Create collection in Postman" action, the captured requests and your Postman API key are transmitted directly from your browser to Postman's official API servers (api.postman.com) via encrypted HTTPS. This transmission is governed by Postman's own privacy terms.

05. Security & Automatic Redaction

Because browser network traffic can capture authentication tokens, cookies, or secrets, the extension includes automated defense-in-depth masking features:

  • Header Redaction: Headers including Authorization, Proxy-Authorization, Cookie, Set-Cookie, and X-API-Key are replaced with Postman environment variable templates (e.g. {{authorization}}) during export.
  • Payload Scrubbing: JSON request bodies and query parameters matching sensitive keys (such as password, access_token, refresh_token, client_secret, otp, secret) are scrubbed and parameterized.
  • Local Verification: Users can inspect the exact JSON collection payload or cURL representation directly within the DevTools panel before downloading or synchronizing.
User Responsibility Notice

While automated heuristics redact common token signatures, users should always review exported collections before publishing to public workspaces or sharing with third parties.

06. Data Storage, Retention & Deletion

All data retention is entirely under the control of the user:

  • In-Memory Lifecycle: Captured network traffic is kept in volatile browser memory. Closing the DevTools panel, refreshing the tab, or clicking the "Clear" button instantly purges the captured request log from memory.
  • Persistent Local Settings: If you click "Save settings", your configuration (Workspace ID, collection name, optional API key) is stored in Chrome's unencrypted local storage (chrome.storage.local).
  • Instant Deletion: You can purge saved settings at any time by clearing the fields and clicking "Save settings", or by simply uninstalling the extension from chrome://extensions, which prompts Chrome to remove all associated local storage data immediately.

07. User Rights (GDPR & CCPA Compliance)

Because we do not store, process, or transmit personal data to remote databases or cloud servers, we do not maintain personal profiles, identifiers, or tracking records.

To exercise your rights to data erasure or access under regulations such as the General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA):

  • Right to Access / Portability: You can download all captured data instantly at any time as standard JSON collections or cURL snippets.
  • Right to Erasure (Right to be Forgotten): Click "Clear" to wipe memory, or uninstall the extension to delete all stored state from your browser.

08. Policy Revisions

We may update this Privacy Policy from time to time to reflect modifications in Chrome Web Store policies or new features in the extension. Any changes will be posted to this page along with an updated "Effective Date". Because the extension has no external communication channel or notification server, users are advised to review this page periodically.

09. Contact Information & Source Code

API to Postman is an open-source project. If you have questions about this Privacy Policy, security suggestions, or need support: