Blackbar Privacy Policy
Last updated: 9 November 2026 (version 1.3.0)
Publisher: runlocaltools · Contact: [email protected]
Blackbar (formerly HAR Sanitizer; same publisher, same extension, new name) is a browser extension that removes secrets and personal data from HAR files (network recordings), images, PDFs and text on your own computer. This policy says what the extension does with your data. In short: your files never leave your device, and the only thing the extension ever sends anywhere is your Pro licence key, to Gumroad, to confirm your purchase. If you do not use Pro, it sends nothing at all.
1. What the extension does with your files#
- A HAR file you open, drop in, paste or record in the DevTools panel is processed in your browser's memory, on your device. The sanitized result is written only when you click a download button, to the place you choose.
- A PDF you open in the PDF tab, and text you paste into the app, are likewise processed in memory only. Blackbar reads each page's text layer on your device to find your Names & terms and to flag scanned pages that have no text. They are not written to storage, and a PDF is exported only when you click download.
- Right-click features (images, selected text, screenshots): the image or text you choose is read from the page you right-clicked, only after your click, and is processed on your device. A chosen image or screenshot is kept as a temporary copy in this browser profile (the same place as images you open in the editor) and removed after 24 hours or when you close it; selected text is held in memory only and cleared when the window reads it. Nothing is sent anywhere.
- The extension has no host permissions by default. Its content-security policy (
connect-src 'self' https://api.gumroad.com) tells Chrome to refuse any outgoing connection from its pages except to its own bundled files (such as PDF fonts) and to that one outside host, which is used only for the licence check in section 6. You can check this yourself on the extension's "Prove it's local" page, which includes a button that tries to send data out to another server and is blocked. - The extension contains no analytics, telemetry, crash reporting, advertising code, or remote code. Every script is bundled with the extension.
- We never see your HAR files, PDFs, screenshots, settings, or licence key. We run no server that could receive them.
2. What is stored on your device#
The extension stores a small amount of data in your browser profile, and nowhere else:
| What | Where | Why | How to remove |
|---|---|---|---|
| Settings: preset, over-redaction level, placeholder style, custom rules, "keep" lists, and your Names & terms list (the names, companies and addresses you ask it to hide) | chrome.storage.local | So your choices persist | Uninstall the extension, or reset in the app |
| Named profiles and per-site settings (a site's hostname is used as the label; Pro) | chrome.storage.local | So a site's settings reload next time | Delete the profile in the app, or uninstall |
| A one-time "What's new" notice after an update (text of the release notes, and whether you dismissed it) | chrome.storage.local | To show what changed once, and clear the "NEW" badge on the toolbar icon | Click "Got it", or uninstall |
| Your Pro licence key, if you have one | chrome.storage.local | To keep Pro active. It is sent to Gumroad, and only to Gumroad, to check it (section 6) | "Remove key" in the Plan tab |
| The date you started the free 7-day Pro trial, if you did | chrome.storage.local | So the trial ends after 7 days and cannot be restarted. It never leaves your device | Uninstall the extension (this also resets the trial) |
| Temporary copy of an image you open in the image editor, including images and screenshots sent from the right-click menu | IndexedDB (harsanitizer-images) in this browser profile | To pass the image between the app tab and the editor tab | Removed automatically after 24 hours; also removed when you uninstall |
Your Names & terms list is stored only on your device, in plain text, so Blackbar can find those words again next time. It is never sent anywhere. Treat it as sensitive: it is included if you export your rules or a profile and then share that file, so check an export before you send it. HAR, PDF and text contents are not written to chrome.storage. The only copy of your content kept outside memory is the temporary image copy in the last row (images and screenshots only).
Uninstalling the extension removes all of the above.
3. DevTools panel#
The DevTools tab reads the network requests of the page you are inspecting, using Chrome's devtools.network API, only while the panel is open. Those requests stay in the panel's memory until you sanitize and download them, clear the list, or close DevTools. The panel also reads the inspected page's hostname (location.hostname) to offer per-site settings. It does not read page content, and it does not run on pages outside DevTools.
4. Encrypted mapping files#
If you choose "Restorable mapping", the extension encrypts the original-to-placeholder table with a passphrase you enter (AES-256-GCM, key derived with PBKDF2) and gives you a file. We never receive the file or the passphrase and cannot recover either. Anyone holding the file and the passphrase can rebuild your original values, so store them separately and never send them together.
5. Links that leave the extension#
A few plain links (for example "See pricing", "More local tools", "Open in HAR Viewer") open runlocaltools.online in a new tab when you click them. They carry no query strings, identifiers, or file contents. What that website records is covered by that site's own privacy policy.
6. Buying Pro, and the licence check#
Pro is a one-time purchase made on Gumroad, not inside the extension. Gumroad processes your payment, emails you your licence key, and holds your purchase details under its own privacy policy. We do not run any server or email service of our own for this.
When you paste your key into the Plan tab and click Activate, the extension asks Chrome for permission to contact api.gumroad.com and then sends Gumroad's licence-check endpoint exactly three values: our product ID, your licence key, and a flag telling Gumroad not to count the check as a use. It does not send your files, settings, browsing data, or any identifier of ours. About once a week after that (and when you press "Check again") it repeats the check, so that a refunded or charged-back purchase stops unlocking Pro. If Gumroad cannot be reached, Pro keeps working for 30 days from the last successful check. The extension stores only the key, its last four characters and the time of the last check; it does not store your email address or anything else from Gumroad's reply.
If you never activate a key, the extension makes no network requests at all. Buying is optional; the free version needs no account, no email, and no payment.
7. Permissions#
- storage: saves the settings listed in section 2.
- contextMenus: adds the right-click items (send an image to the editor, sanitize selected text, sanitize in place, redact part of a page).
- activeTab: when you click one of those items or press the shortcut, Chrome lets the extension work on that one tab for that moment. It is not used on other tabs and does not give access to any site by itself.
- scripting: used on that one tab, only right after your click, to read the image or text you chose and, for Pro, to put sanitized text back into the text box. There are no content scripts, so nothing runs on pages otherwise.
- DevTools page: adds the "Blackbar" tab to Chrome DevTools (section 3).
- api.gumroad.com (optional host permission): requested only when you activate a Pro key, used only for the licence check in section 6.
- No other host permissions, no
tabs, nonotifications, nodownloads, nowebRequest, nocookies. (Downloads use a normal browser save, which needs no permission.)
8. What we do not do#
We do not collect personal data, sell or rent data, use data for advertising or creditworthiness, or transfer your files or settings off your device. The licence key is sent to Gumroad only to provide the licence check you asked for. There is nothing to opt out of; not activating a key means nothing is sent.
9. Children#
The extension is a developer tool and is not directed at children. It collects no data from anyone.
10. Changes#
If this policy changes, the new version will be posted at the same address with a new "Last updated" date, and the extension's store listing will be updated to match. Any change that involves collecting data would also require a new version of the extension and fresh disclosure in the Chrome Web Store.
11. Contact#
Questions or concerns: [email protected]
Limits of the tool: Blackbar finds secrets by name and known patterns, and the names and terms you list. It cannot prove a file is free of sensitive data. Review a sanitized file before you share it.