Privacy Policy for ThenAndThere
This Privacy Policy describes how ThenAndThere (“the Extension,” “we,” “us”) handles information when you install and use our Chrome browser extension.
ThenAndThere is a developer tool that watches for failed HTTP requests in your browser and helps you find matching entries in AWS CloudWatch or GCP Cloud Logging. The Extension runs entirely in your browser. We do not operate a backend service for the Extension, and we do not receive or store your data on our servers.
If you have questions about this policy, contact us at: gordan@theglobulus.com.
Summary
| Topic | What we do |
|---|---|
| Data sent to us | None. The Extension does not phone home. |
| Analytics / telemetry | None from the Extension developer. |
| Where your data lives | In your browser (chrome.storage) and in cloud log services you configure. |
| Third parties | Only the cloud providers you connect to (AWS and/or Google). |
| Selling data | We do not sell your data. |
1. Who this policy applies to
This policy applies to users of the ThenAndThere Chrome extension distributed via the Chrome Web Store.
The operator of the Extension is:
Globulus d.o.o.
gordan@theglobulus.com
2. Information the Extension processes
The Extension processes information locally on your device to provide its features. Depending on how you use it, this may include:
2.1 Configuration you provide
When you create a “project,” the Extension stores settings you enter, such as:
- Project name and API host patterns
- Failure HTTP status codes and optional path transforms
- AWS: region, CloudWatch log group names, and authentication details (static IAM access keys, session tokens, or AWS IAM Identity Center / SSO settings)
- GCP: project ID, optional log filters, and authentication details (service account key material or OAuth client ID)
This configuration is saved in chrome.storage.local on your
device. Credentials are not encrypted at rest by the Extension; they
remain on your machine under your browser profile’s control.
2.2 Network request metadata
To detect failures and suggest new projects, the Extension uses the Chrome
webRequest API to observe XHR/fetch traffic.
For matching or observed requests, it may process:
- Request URL (including path and query string)
- HTTP method and response status code
- Request timing (start/completion timestamps)
-
Selected response headers (for example
Date,x-request-id,x-amzn-requestid,x-amzn-trace-id) - The page origin that initiated the request (
initiator), when available
The Extension does not read request or response bodies.
Failed requests for configured projects are stored temporarily in
chrome.storage.session (up to 100 recent failures). Host
observations for tabs without a matching project are also stored in session storage, capped
in size, and used only to pre-fill the “add project” form.
2.3 Authentication tokens and derived credentials
Depending on your chosen auth method, the Extension may cache:
-
AWS SSO: OIDC access/refresh tokens and OIDC client credentials in
chrome.storage.local -
AWS SSO (derived): short-lived STS role credentials in
chrome.storage.session -
GCP: short-lived OAuth or service-account access tokens in
chrome.storage.session
These tokens exist solely so the Extension can query logs on your behalf without asking you to sign in on every failure.
2.4 Log data from your cloud account
When you open the side panel for a failure, the Extension queries your AWS or GCP account (using credentials you supplied) and retrieves log entries for display. That log content may contain arbitrary application data—including personal data if your logs contain it. We never receive this log content. It is fetched directly from AWS or Google to your browser and shown in the Extension UI.
3. How we use information
We use the information above only to:
- Detect HTTP responses that match your configured failure criteria
- Correlate failures with candidate log entries in CloudWatch or Cloud Logging
- Remember your project settings and authentication state between sessions
- Suggest API hosts when setting up a new project
- Open deep links to the AWS or GCP console when you choose to
We do not use your information for advertising, profiling, or marketing.
4. Where information is stored and how long it is kept
| Data | Storage location | Retention |
|---|---|---|
| Project configuration & AWS SSO tokens | chrome.storage.local |
Until you delete them or uninstall the Extension |
| Failed requests, host observations, short-lived cloud tokens | chrome.storage.session |
Cleared when the browser session ends (browser restart) |
| In-memory request timing | Extension service worker memory | Cleared when the service worker is evicted or the browser restarts |
You can remove project data at any time from the Extension’s Projects options page, or by uninstalling the Extension and/or clearing the Extension’s site data in Chrome.
5. What we share—and what we do not
5.1 We do not share data with the Extension developer
The Extension does not transmit your configuration, browsing activity, credentials, or log results to us or to any server operated by the Extension developer.
5.2 Cloud providers you configure
To fetch logs, the Extension sends API requests directly from your browser to:
- Amazon Web Services (for example CloudWatch Logs, IAM Identity Center OIDC endpoints)
- Google (for example Cloud Logging API, Google OAuth)
Those requests are governed by the privacy policies and terms of AWS and Google, respectively. You choose which accounts, credentials, and log scopes to use. We recommend using read-only credentials scoped to log viewing.
5.3 Google Chrome
The Extension is distributed through the Chrome Web Store. Google may collect information about extension installs and updates as described in Google’s Privacy Policy.
5.4 No sale of personal information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
6. Permissions and why they are needed
The Extension requests the following Chrome permissions:
| Permission | Purpose |
|---|---|
webRequest + <all_urls> |
Observe XHR/fetch responses to detect failures and suggest API hosts. Limited to metadata; no body access. |
storage |
Save projects, session failures, and auth caches locally. |
sidePanel |
Show correlated log candidates beside the page you are debugging. |
identity |
Optional interactive Sign in with Google for GCP Cloud Logging (OAuth redirect flow). |
The broad host permission is required because API failures can occur on any origin you develop against (localhost, staging, production). The Extension only acts on traffic relevant to its features; it does not modify requests or inject scripts into pages.
7. Security
Security depends in part on how you configure the Extension:
- Prefer short-lived credentials (AWS SSO, STS session tokens, GCP OAuth) over long-lived static keys where possible.
- Use least-privilege IAM / GCP roles limited to reading logs.
- Be aware that project configuration—including static AWS keys or GCP service account private keys—is stored unencrypted in local browser storage.
Protect access to your computer and Chrome profile. Anyone with access to your unlocked browser profile may be able to read stored credentials.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or restrict processing of personal information.
Because we do not collect or store your data on our servers, the primary way to exercise these rights is on your device:
- Delete individual projects in the Extension options page
- Sign out of AWS SSO or Google OAuth by removing the relevant project or clearing Extension storage
-
Uninstall the Extension to remove its stored data (you may also clear
Extension data under
chrome://extensions)
If you need help, contact us at gordan@theglobulus.com.
For users in the EEA/UK, our legal basis for processing (where applicable) is legitimate interests in providing the Extension you chose to install, and contract where necessary to deliver the functionality you request. You may lodge a complaint with your local data protection authority.
For California residents: we do not sell personal information. Because we do not receive your data, many CCPA access/deletion requests are most effectively handled by you deleting local Extension data as described above.
9. Children
The Extension is intended for software developers and is not directed at children under 13 (or 16 where applicable). We do not knowingly collect personal information from children.
10. International transfers
The Extension runs on your device. If you configure AWS or GCP in regions outside your country, your log queries may be processed by those providers in accordance with their policies.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date at the top. For material changes, we may provide additional notice (for example in the Chrome Web Store listing).
Continued use of the Extension after an update means you accept the revised policy.