Noggin
Privacy & permissions
What Noggin stores
Your header names, values, on/off states, and the master switch are stored only in
Chrome's local extension storage (chrome.storage.local) on your own machine.
Noggin never sends your configuration to us or to any service of its own. Uninstalling
Noggin removes this data and stops all header changes.
Where your headers go
While a header is switched on, and the master switch is on, Noggin adds it to every request your browser makes, on every website. That includes requests to other servers loaded by the page you're on, such as images, scripts, ads, and analytics. All of those servers receive the header's name and value. If a request already carries a header with the same name, Noggin replaces its value.
What Noggin doesn't do
No accounts, no cloud sync, no analytics, no ads, no tracking. Noggin makes no network calls of its own — it only changes the headers on requests your browser is already making.
Why Noggin needs broad permissions
Enabled headers may be added to requests across websites — that's the whole point of Noggin, so you never have to re-enable a header per site. That's why it asks for permission to read and change data on all websites, Chrome's standard phrasing for the permissions used to add headers to outgoing requests. Noggin cannot read the content of pages you visit or your browsing history; it can only attach the header values you've configured to outgoing requests.
A note on secrets
Don't use passwords, session cookies, API tokens, or other credentials as header values. An enabled header is sent to every server your browser contacts, so a secret would be shared with all of them. Noggin also stores values unencrypted and doesn't mask them in its popup. It isn't built to be a secrets manager.