ContextForge Privacy Policy

Last updated: 2026-09-01

ContextForge ("the extension") is a Chrome extension for QA testers and developers. It captures debugging context (console errors, failed network requests, screenshots, and tester notes) from a web page during a testing session and turns it into a prompt for an AI coding assistant.

Summary

ContextForge does not have a backend server. It does not transmit any data it captures to CoderFromMars LLC, to the extension developer, or to any third party.
All captured data stays on your device, in the browser's local extension storage (chrome.storage.local), until you export it or clear it yourself.
ContextForge only captures data while you have explicitly started a capture session. It is inactive on all sites by default.

What ContextForge Captures

When you start a session on a page, and only for that page, ContextForge may capture:

Console and JavaScript errors — console.error/console.warn output, uncaught exceptions, unhandled promise rejections, failed resource loads (a script/stylesheet/image/font that didn't load, and its URL), and blocked Content-Security-Policy violations (the blocked URL and which policy directive stopped it), including message text and stack traces where available. Known analytics/tracking hosts are excluded from the last two so a third-party tracker being blocked doesn't show up as noise.
Network activity — requests made by the page via fetch/XMLHttpRequest, including URL, HTTP method, status code, a truncated preview of the request/response body, and a filtered set of request/response headers.
Notes — three ways to leave one, always written by you: annotating a UI element you right-click (CSS selector, XPath, visible text, nearby DOM structure, and an optional screenshot); a free-text general note or action item with no element data attached, either from that same right-click flow or typed directly in the Notes tab; or a question attached to a specific API Traffic call, which copies that call's already-masked request/response detail (see "What ContextForge Deliberately Does Not Capture" below) into the note so it stays reviewable later.
Storage inventory — the names and sizes of localStorage/sessionStorage keys present on the page (not their values).
Detected tech stack — best-effort detection of frameworks/libraries in use (e.g. "React 18", "Next.js 14") and browser/viewport info.
Recorded actions (optional feature) — a sequence of clicks, typed values, and navigations you record for later playback.
Device View (optional feature) — when turned on, ContextForge attaches Chrome's debugger protocol to the tab under test to apply a mobile viewport/user-agent override (the same mechanism Chrome DevTools' own device toolbar uses). This only changes how the page under test renders and identifies itself — it does not capture or transmit any additional data, and detaches automatically when you switch back to Desktop.
Security Inspector (optional Pro feature) — passively checks the site you're testing for common security misconfigurations: exposed secrets in its JavaScript, sensitive fields in API responses, insecure cookies, permissive CORS, missing security headers, unsafe HTML patterns, and mixed HTTP content. To do this, it may: read the response headers of the page you're on; read the names and security flags (not values) of cookies on the site's domain; and fetch the text of scripts the page itself already loaded, to scan for exposed secrets. Findings are computed fresh each time and are not saved automatically — they only persist if you explicitly click "Save Report," which stores that snapshot locally in the extension's IndexedDB storage until you delete it. Everything here is passive observation; ContextForge never attempts to exploit a finding, brute-force anything, or send data to the site beyond requests the browser would already make loading it normally.
Site Scan (optional Pro feature, part of Security Inspector) — on your explicit request, automatically navigates the current tab through other pages of the same site (links found on the page, same domain only, capped at 25 pages) to run the same passive checks across the whole site in one pass. It never follows links to a different domain, never fills in or submits a form, never clicks a button, and never attempts to log in — it only follows links, the same as a person clicking through the site manually. You are responsible for only running Site Scan (or any Security Inspector feature) against sites you own or have explicit authorization to test — see the Terms of Service for details.

What ContextForge Deliberately Does Not Capture

Request/response bodies and headers are filtered before they are ever written to storage:

Values for known sensitive fields — password, token, access_token, refresh_token, authorization, cookie, set-cookie, ssn, dob, credit_card, cardNumber, cvv — are replaced with ***.
Sensitive headers — Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token, X-Session-Token, Proxy-Authorization — are replaced with ***.
When recording actions, values typed into password fields are redacted and marked as sensitive rather than stored in plain text.
Bodies are truncated to a preview length; full request/response payloads are never stored.

This masking is a best-effort safeguard, not a guarantee — it matches on known field/header names and cannot detect sensitive data embedded in unexpected places (e.g. a secret inside a free-text field). Avoid running capture sessions on pages where request/response bodies may contain sensitive data you don't want previewed, and review captured content before sharing it.

Where Data Is Stored

All captured session data — errors, network activity, notes, screenshots, and recordings — is stored locally using the Chrome extension storage API (chrome.storage.local), scoped to your browser profile. Notes, recorded actions, and any Security Inspector report you explicitly choose to save are stored locally in the extension's IndexedDB database, also scoped to your browser profile. None of this is synced to a cloud account we operate, and none of it is accessible to other extensions or websites.

How Data Leaves the Extension

Data only leaves ContextForge's local storage when you explicitly choose to:

Copy the generated prompt, or a Security Inspector report, to your clipboard.
Download the generated prompt as Markdown (.md, or a .zip alongside its screenshots), a recorded action as JSON (.json), a Security Inspector report as Markdown, or your notes as a PDF — to your own device.

You decide where that exported file or clipboard content goes next (e.g. pasting it into an AI coding assistant). ContextForge itself does not upload, sync, or transmit captured data anywhere.

One exception: to resolve a UI note to its original source file, or to scan a script for exposed secrets (Security Inspector), ContextForge may fetch a page's own JavaScript source file(s) directly from the site being tested, the same way browser DevTools does. This is a request to the site you're already testing, not to any ContextForge-operated server, and no captured session data is included in that request.

A second exception: ContextForge is free to try for 30 days, after which some features require a one-time paid license. License verification is handled entirely by LemonSqueezy (our payment processor), not by any server of our own — ContextForge has no backend of its own. When you activate a license key, ContextForge sends that key and a randomly generated identifier for your browser install (not tied to your identity) directly to LemonSqueezy's license API to confirm it's valid. No QA capture data — errors, network activity, notes, screenshots, or recordings — is ever included in this request or seen by LemonSqueezy.

A third exception: to keep the 30-day trial clock from resetting on every reinstall, ContextForge also records the trial start date in two additional places, alongside the copy kept in local storage: a browser cookie scoped to coderfrommars.com, and Chrome's built-in extension sync storage (chrome.storage.sync), which — if you're signed into Chrome with sync enabled — is stored by Google and associated with your Google account so it can survive a reinstall. Neither of these ever involves a request to any server we operate; the cookie is set directly via Chrome's cookie API, and sync storage is handled entirely by Chrome/Google's own sync infrastructure, not by us.

A fourth exception: Folder Sync (Pro feature) mirrors a project's notes, actions, and generated prompt — including note screenshots — to a folder on your own device, one you explicitly pick and grant access to via Chrome's File System Access API. This writes files to your local disk only; nothing is uploaded anywhere as part of Folder Sync, and you can unlink the folder at any time the same way you'd revoke any other site/file permission in Chrome.

Data Retention and Deletion

Captured sessions and recordings remain in local storage until you clear them. ContextForge provides a "Clear Live Data" action in the side panel for the current session's errors/network activity; notes, recorded actions, and saved Security Inspector reports can each be deleted individually, or all at once by deleting a project. Deleting the extension removes all of its stored data.

Permissions

See the extension's Chrome Web Store listing for a plain-language explanation of why each permission (host access, tabs, scripting, downloads, contextMenus, debugger, cookies, webRequest) is required.

Changes to This Policy

If ContextForge's data practices change, this document will be updated and the "Last updated" date above will reflect the change.

Contact

Faraz Jafri — CoderFromMars LLC
hello@coderfrommars.com
support@coderfrommars.com