Chrome Extension

Privacy
Policy.

Effective October 3, 2026

A public record of what Dex accesses, where processing occurs, how long information remains, and the controls available to each user.

00 Preamble

Purpose

Dex manages Chrome downloads and inspects downloadable resources on the current web page.

This policy describes the data Dex accesses to provide those functions. Download, tab, page-resource, and settings data is processed locally in the browser and is not transmitted to the developer.

Chrome download information

Download URLs, file names and local file paths, file type, size, progress, timestamps, status, and error or danger state.

Used for download display and controls.

Tab context

The URL and title of the active or target browser tab.

Used to open and route Dex on the intended page.

Page resource information

Resource URLs, element titles or alternative text, media dimensions and duration, resource type, and observed transfer size.

Used by the current-page resource inspector.

Extension preferences

User-selected settings, panel size, and pending approval identifiers and terminal recovery event metadata.

Used to preserve the expected Dex experience.

Dex does not request or read browser cookies, form input, passwords, authentication tokens, personal communications, payment information, health information, or precise location. When a user explicitly copies a displayed URL, Dex writes that selected value to the clipboard but does not read clipboard contents.

Inside Chrome

Chrome download events and user actions

Local Dex processing and display

Chrome extension storage when persistence is needed

Original resource host

A download or page resource needs a size check, or a user asks to preview an image/poster

Size check: HEAD to the original URL. HTTP image/poster preview: bounded GET only when the page and resource are exact same-origin HTTP

Size metadata or, for a preview, only an image response up to 2 MiB is used; preview requests omit credentials and referrer, reject redirects, and time out after 10 seconds

HTTP preview GETs are limited to the current HTTP page's exact origin, run at most four at a time, and are not redirected through a Dex backend or a separate third-party service. HTTP audio/video previews fail closed; HTTPS media remains native.

Settings

Stored with chrome.storage.sync.
Remain until reset, removal, or uninstall.
Chrome may synchronize them according to the user's Chrome sync configuration.

Local extension state

Panel size and pending approval identifiers use chrome.storage.local. Terminal recovery envelopes contain event identity, worker generation, source, status and allowed DownloadDelta fields, which can include local paths and other download metadata. They use chrome.storage.session, falling back to chrome.storage.local only if session storage is unavailable.
Approval entries are removed when resolved. Recovery envelopes are settled and retired after processing; processing or storage failures can retain them until recovery succeeds. If startup erase evidence exceeds the bounded capacity while storage is unavailable, uncertain older records remain isolated without replaying notifications or actions. Retained erase evidence is applied automatically when storage recovers; unresolved records remain until the user explicitly ends their notification recovery in Manager (or extension storage is removed). This does not remove Chrome download history or files. The owner and browser quota bound storage.
Local extension storage is removed when Dex is uninstalled.

Page inspection

Results are held in memory for the active page session.
The reusable idle object-URL cache is bounded at 16 MiB; live attached preview sources are retained separately until released.
Inspection results are not uploaded by Dex.

Downloads

History and downloaded files are managed by Chrome and the operating system.
Users can remove history entries or files through Dex, Chrome, or the operating system.

Optional local previews and context

Local image, audio and video content previews are off by default. Manager requires both the Dex local preview setting and Chrome's independent file URL access switch. File content is loaded locally through browser media elements, is not uploaded by Dex, and its media source is released when the preview closes or changes. Browser-native remote media loads follow normal browser cache and network behavior.

Dex does not support incognito windows and cannot be enabled in incognito mode. Disabled legacy credentialed HEAD/Range progress helpers are skipped before fetch and are not active transfers.

Sharing and advertising

Dex does not sell user data or send it to the developer, advertisers, or data brokers. Original resource servers receive the resource URL and ordinary request/network metadata during size checks and remote previews. It does not use data for advertising, profiling, creditworthiness, or purposes unrelated to its stated functionality.

Security

Dex uses Chrome extension APIs and local extension storage. Release builds package all executable code locally and do not download or run remote code.

User controls and deletion

Users can reset Dex settings, clear Chrome download history, delete downloaded files, reload a page to discard session resource results, manage Chrome sync, or uninstall Dex to remove extension storage.

V Limited Use

Chrome Web Store Limited Use

Data is used only for Dex's user-facing purpose.

Dex's use and transfer of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Dex uses such information only to provide or improve its download-management and resource-inspection features.