HubTools Privacy Policy
Last updated: 2026-11-13
HubTools is a developer tool for testing HTTP headers against CDN and WAF configurations.
Purpose
HubTools is an internal testing and troubleshooting tool for personal use and for a team the owner chooses. It exists to make testing and diagnosing CDN, WAF and staging behaviour on systems the user owns or is authorised to test easier. It is not intended for attacking, bypassing protection on, or probing systems without permission, and it collects nothing.
What HubTools handles
- Rules you create (header names, values, hosts, paths) and your settings.
- Response headers of pages you open on hosts you have allowed, shown in the Inspect section. Cookie values are redacted before storage; only cookie names and flags are kept. The same applies to request headers: Cookie values, Authorization and token-like headers are replaced with [redacted], and the capture lives only in memory-only session storage.
Where it is kept
- Rules and settings are stored locally in your browser (
chrome.storage.local). If you turn on the vault, they are encrypted with AES-256-GCM using a key derived from your passphrase. The passphrase and key are never stored on disk. - Captured response headers are kept in memory-only session storage and discarded when the tab or browser closes.
Ad and tracker blocking
The Shield section blocks requests to a built-in domain list using the browser's own rule engine. It does not read page content, does not report what was blocked, and keeps only your on/off choices and paused sites locally.
PhishGuard
PhishGuard scores how risky a page looks. It uses the page address and, on sites you have allowed, a few facts read from the page: its title, how many password boxes it has, the hostnames its forms send data to, and the hostnames of links whose text shows a different address. Everything is worked out inside your browser from built-in rules. Nothing is looked up, stored or sent anywhere, and the page content itself is not read.
Check every site is off by default. If you switch it on, Chrome asks you for access to all sites, and each page is then checked in the same way when it finishes loading. On a high-risk page with a password box, HubTools can add a warning bar to the page; nothing else on the page is changed. Your PhishGuard choices and your list of trusted sites are saved locally with your settings. You can take the access away again at chrome://extensions.
Live log
Live log is off by default. When you switch it on, HubTools lists the requests made by the current tab to sites you have allowed: the address, method, status code, type, timing, the server's IP address and its cache result. Addresses are kept without fragments and with secret-looking query values replaced by [redacted]. The list holds the newest 300 requests per tab in memory-only session storage, restarts on each page load, and is discarded when the tab or the browser closes. It is never sent anywhere; it leaves the browser only if you press Copy or Export.
Privacy X-Ray
When you open Privacy X-Ray on a site you have allowed, HubTools reads the hostnames of the resources the current page loaded (not their full addresses, and not the page content) to list the third-party sites involved. The list is shown in the panel only: it is not stored and not sent anywhere. Sites you choose to block there are saved locally with your Shield settings.
Optional DNS lookup
If you press DNS lookup in the Inspect section, the hostname of the current page is sent to cloudflare-dns.com (a public DNS-over-HTTPS resolver) to read its CNAME and A records. Nothing else is sent, and it only happens when you press the button.
Screenshot
The camera button captures the visible part of the current page together with the HubTools panel and puts the image on your clipboard. The image is not saved, uploaded or sent anywhere.
Connection details
The Inspect section reads the current page's navigation timing (protocol, connection and load times, transfer sizes) from the browser. It does not read page content, and the values stay in the popup.
Optional certificate lookup
If you press Certificate lookup, the hostname of the current page is sent to crt.sh (a public Certificate Transparency search) to list its certificates, or to Cert Spotter (api.certspotter.com) if crt.sh is busy. Nothing else is sent, and it only happens when you press the button. Chrome asks for access to those two services the first time.
Report captures
When you use Report mode, pages you capture are saved as images inside this browser (IndexedDB) so you can build a PDF. They are never uploaded or sent anywhere. They stay until you remove them (the x button, or Clear all). Page text, titles and web addresses of captured pages are stored with each image, together with any notes you type.
Expanding scrolling areas
For the Alt+V capture, scrolling boxes inside the page are temporarily opened so their full content can be captured. Only display styles are changed, nothing is read or sent, and every style is put back right after the capture.
Screen capture
In Screen capture mode the captured image is kept in this browser's storage only while its tab is open (older leftovers are removed automatically), so the tab can show it, copy it to your clipboard, and save it as an image or PDF when you press the buttons. It is never uploaded or sent anywhere.
Screen record
Screen record captures video only of the tab, window or screen you pick in Chrome's own share dialog, and only while Chrome shows its sharing bar. If you switch the microphone on, Chrome asks for your permission first. Recordings are held in the recorder window's memory and are written to your device only when you press Save. They are never uploaded or sent anywhere, and closing the recorder window discards anything not saved. Only your recorder settings (source, sound, microphone, quality, format) are stored.
Workspaces
When you save a workspace, HubTools stores the web addresses, titles and pinned state of the tabs in the current window, under the name you give it, in this browser's local storage. Chrome asks for your permission to read tab addresses the first time. Nothing typed into pages, no logins and no page content are saved. Workspaces are never uploaded or sent anywhere, and they are not encrypted by the vault. Delete a workspace to erase it.
What is sent over the network
- Nothing is sent to the developer or to any third party. There is no analytics, telemetry, advertising or remote code.
- The Cache probe and WAF probe (under Test, Probes) send requests only to the URL you type, without cookies or credentials. The WAF probe requires you to confirm that you own or are authorised to test the host.
- Compare, the Rate limit check, the Request builder, the Security headers check and the Redirect trace (all under Test) work the same way: requests go only to the address you type, without cookies or credentials. The Rate limit check sends at most 50 requests and needs the same confirmation as the WAF probe.
- The DNS lookup under Test, Lookup sends the host name and record type you choose to cloudflare-dns.com, and only when you press Look up.
- Header rules modify requests your browser already makes, only for hosts you allowed.
What is never done
HubTools does not sell or transfer user data, does not use data for advertising or creditworthiness, and does not send your browsing history anywhere. Web addresses are kept only in the two cases described above (a workspace you save, and the Live log while you have it switched on), and they stay in your browser.
Permissions
Host access is optional and requested one host at a time. The only request for all sites is PhishGuard's Check every site, and only when you switch it on. You can revoke access any time in chrome://extensions. Two further permissions are optional and asked for only when you use the feature: reading tab addresses (Workspaces) and clearing one site's cache (Clear site cache).
Your control
Delete a rule, a profile, or remove the extension to erase its data.
Contact
Questions about this policy or about HubTools: mfaezul50@gmail.com