To use these add-ons, you'll need to download Firefox.

Log in
Add-on icon

Privacy policy for Rayamap

Rayamap by taqi raya

0 Stars out of 5
5
0
4
0
3
0
2
0
1
0
Privacy policy for Rayamap

Rayamap: Privacy & permissions

Version 1.2.1 · Updated October 21, 2026

Your targets and browser access

Rayamap maps HTTP(S) network requests only for the exact domains and wildcard scopes you add. Initial setup opens after installation and asks you to approve persistent access to all HTTP and HTTPS websites. This supports research across multiple domains and cross-site requests without repeated permission prompts. Access is optional: mapping and extraction controls stay disabled if you decline, and Enable access lets you retry later. You can revoke access in your browser's extension settings. Stop Mapping and removing targets do not revoke the initial access grant.

Broad browser access does not expand capture scope: only matching target requests are recorded, and capture stays off until you choose Start Mapping. A new browser session requires starting capture again. Capture can include requests from multiple tabs that match your selected targets.

Local data

Matching request URLs (including query values), HTTP methods, response status and metadata, request bodies, extracted endpoints and potential secret matches are stored in extension storage on this device. These may contain sensitive information. No developer-operated server, analytics or advertising service receives captured data. Up to 10,000 request records are retained. Read history and discovered secrets are kept until you delete them. Browser profile access can expose locally stored data.

Capture coverage

All HTTP(S) resource types within your targets can be recorded, including images, stylesheets, fonts, scripts and media, plus redirects, pending requests and network errors. Rayamap also reads resource URLs and Resource Timing entries from target pages while mapping to recover references to already-loaded or cached assets. This page-resource observation uses only code packaged with the extension, makes no extra network requests and does not change the page. These references are labelled separately with OBS when an HTTP status is unavailable; unknown request methods remain UNKNOWN. Response metadata from actual network events replaces matching page references.

Image and other binary response contents are not downloaded or stored. Raw request-body text previews are limited to 1 MiB; truncation and missing upload bytes are indicated. The browser may not expose every cache, upload or protected-page event. A URL hosted on a subdomain or external CDN must match a target scope to be retained. Repeated method/URL pairs update the same record; up to 10,000 unique records are retained, with older records replaced as new traffic arrives.

Optional JavaScript extraction

Extract endpoints & detect secrets is enabled by default after you approve setup, and can be switched off in the popup. While mapping with extraction enabled, Rayamap makes additional GET requests to observed, in-scope JavaScript files using session cookies allowed by your browser. It follows no redirects, executes no downloaded JavaScript and submits no forms or attack payloads. File text is searched locally for endpoints and possible key/token patterns. These matches are not verified vulnerabilities. Stop Mapping cancels pending extraction.

Optional Gemini analysis

Load models sends your API key to Google's Gemini API to list models. Analyze target sends your API key and the previewed summary of the website you select to Google for processing only after you agree to the data transfer and click Analyze. The summary contains target host/origin, paths, methods, query and body parameter names, status, source/tags, New status and aggregate potential-secret pattern counts. Query values, cookies, raw request bodies and discovered secret values are excluded. Known discovered secret values are redacted in metadata; other sensitive content embedded in paths or parameter names may remain, so review the preview.

The recipient is generativelanguage.googleapis.com. Google also receives ordinary network information such as your IP address. Google's terms, privacy and account settings govern its processing and retention. API quota or charges can apply. Rayamap does not use AI responses as executable code.

By default your API key is kept in browser-session extension storage where supported, otherwise in the dashboard tab. Remember API key on this device stores it locally without encryption. Forget key removes the saved key. Reports are not saved automatically; downloads are files under your control.

Controls and deletion

  • Start / Stop controls capture; the JS checkbox controls extraction.
  • Removing a scope changes capture scope. Stop Mapping cancels capture and extraction, while the setup permission remains granted for future sessions. Site data remains until deleted.
  • Delete site data removes matching captured URLs, secrets and read history. Clear removes all captured results.
  • Browser extension settings let you revoke site and, on supported Firefox versions, optional data-sharing permissions.
  • Forget key clears the stored API key. Removing Rayamap removes its extension storage; exported files remain until you delete them.

Permissions and executable code

webRequest observes permitted target traffic; scripting runs packaged resource-URL observation code in isolated target-page contexts while mapping; storage keeps settings/results; unlimitedStorage supports substantial local research captures; HTTP(S) website access is optional and requested once during setup, then retained until you revoke it. No tabs or activeTab permission is required. On supported Firefox versions, setup also requests native data consent for authenticated extraction and optional AI. AI additionally requires explicit in-product consent before transmitting any summary to Google. All executable scripts ship inside the extension. External JS files and AI responses are treated as data, never executed.

Use and support

Use Rayamap only for systems you own or have authorization to assess. For support, use the verified contact on Rayamap's official store listing.

Google Privacy Policy (https://policies.google.com/privacy) · Gemini API terms (https://ai.google.dev/gemini-api/terms)