Privacy Policy for PostHog Debugger (Unofficial)

Last updated: 2026-07-25

PostHog Debugger (Unofficial) is a Chromium and Firefox DevTools extension for developers who want to inspect PostHog analytics behavior on pages they are debugging.

This extension is not an official PostHog product and is not affiliated with, endorsed by, or sponsored by PostHog.

Summary

The extension processes debugging data locally in the browser. It does not send the inspected analytics data, browsing data, or page data to the developer of this extension or to any remote service controlled by the developer.

Data the Extension Can Inspect

When Chrome DevTools is open on a page, the extension can inspect PostHog-related debugging data from that inspected page, including:

PostHog analytics event names and event properties;
PostHog request URLs, endpoints, status codes, request sizes, and timing;
PostHog request payloads and selected feature flag responses;
PostHog distinct IDs, session IDs, session replay URLs, feature flag keys, feature flag values, feature flag payloads, group data, and SDK configuration values when exposed by the page’s posthog-js instance;
top-frame and iframe URLs/origins used to attribute where captured events came from;
validation warnings generated by the extension, such as missing IDs, failed requests, duplicate events, large payloads, or possible personally identifiable information in event properties;
local analytics linting findings, including event names, property keys, required-property rule names, and naming-style results when the linting feature is enabled.

The exact contents depend on what the inspected website sends to PostHog. If the website includes personal information, authentication-like values, location data, or other sensitive values in its PostHog event payloads, those values may appear inside the local DevTools panel.

How the Extension Uses Data

The extension uses inspected data only to provide its user-facing debugging features:

showing live PostHog events in the DevTools panel;
decoding and formatting PostHog payloads;
showing raw PostHog network request health;
showing PostHog feature flag and session state;
generating local validation warnings for likely analytics implementation mistakes;
generating local analytics lint reports from the active local tracking plan when the linting feature is enabled.

Local Processing and Storage

Captured data is stored in memory in the inspected page and in the DevTools panel state while DevTools is open. The extension does not use Chrome extension storage, IndexedDB, or a remote database to persist captured analytics payloads. The welcome page uses Chrome extension storage only to remember whether its first-run guide is pending, completed, or dismissed; this marker contains no identity or inspected-page data. The panel may use localStorage for local UI preferences, the linting tracking-plan JSON, and a rating-prompt preference. The rating preference stores only qualifying local-use dates, a deferral timestamp, and whether the user dismissed or followed the review or feedback link; it does not store an identity or inspected-page data. The feedback link opens the user’s email app with only the subject PostHog Debugger feedback prefilled. It does not prefill or send diagnostics, inspected-page data, or an identity. The tracking plan is user-provided configuration and does not include captured event property values unless the user manually enters them.

Closing DevTools, navigating away from the page, reloading the page, or using the extension’s clear control removes the current in-memory debug view.

The extension does not sell, share, transfer, or transmit inspected analytics data or browsing data to third parties.

The extension does not send inspected data to PostHog. It observes PostHog requests that the inspected website is already making.

The developer of this extension does not receive the inspected analytics payloads or browsing data through the extension.

In Chromium, the extension registers a public optional feedback page for the browser to open after uninstall. Registering that page sends no data and includes no query parameters, identifiers, extension-session data, or inspected-page data. The page may be closed without responding. If a person voluntarily submits the page’s Tally form, Tally receives only the selected reason and any optional text the person enters; please do not submit personal, sensitive, or inspected-page information. Tally processes that direct form submission under its privacy notice. If the browser does not support or allows no uninstall page, no feedback page opens and the extension continues to work normally until it is removed.

First-Party Extension Usage Analytics

The extension may send limited, cookieless product usage events to the developer’s PostHog project. These events contain only allowlisted interaction categories, count buckets, extension version, extension browser (chromium or firefox), extension build variant (external or internal), and optional internal debug markers. They do not contain inspected-page URLs, event names, properties, payloads, distinct IDs, inspected-page flag keys, or other inspected-page data.

Usage analytics uses a random in-memory session ID, is not persisted, disables autocapture and session recording, and ends when the DevTools panel closes. It sends events and feature-flag requests to https://eu.i.posthog.com; the bundled client may also request its PostHog configuration from https://eu-assets.i.posthog.com. The same first-party PostHog project may evaluate extension feature flags, such as the analytics linting rollout flag, using that in-memory session. Feature-flag evaluation does not include inspected-page URLs, event names, properties, payloads, distinct IDs, inspected-page flag keys, or other inspected-page data. Firefox usage analytics and feature-flag evaluation start only when the user grants the optional technical and interaction data permission. Declining or revoking that permission does not affect debugging features.

Remote Code

The extension does not load or execute remotely hosted extension code. Its extension pages and content script run from the packaged extension files.

Permissions and Site Access

The Chromium package requests only the storage permission for the non-identifying first-run onboarding marker described above. Firefox declares optional technical and interaction data collection consent for the limited usage analytics described above.

The content script runs on HTTP and HTTPS pages, including iframes, because developers may use PostHog on arbitrary websites, staging environments, embedded widgets, localhost tunnels, reverse proxies, and self-hosted PostHog setups. The content script is used to detect PostHog-shaped analytics requests and expose local debugging state to the DevTools panel for the currently inspected page.

Limited Use Statement

The extension’s use of inspected data is limited to the user-facing debugging features described in this policy and in the Chrome Web Store listing. The extension does not use inspected data for advertising, profiling, resale, credit worthiness, or any purpose unrelated to PostHog analytics debugging.

The use of information handled by this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Contact

For privacy questions, support, or bug reports, use the public support page:

https://glechyan.com/extensions/posthog-debugger/support/

Support requests are handled through GitHub Issues:

https://github.com/Gevorg-Glechyan/posthog-debugger/issues