CompatLens runs entirely inside your DevTools. There is no account, no backend and no analytics. The extension makes no request of its own to anywhere: the compatibility data is compiled in at build time. Stylesheet bodies come from the DevTools resource APIs, which serve them from what the page already loaded, and, where those APIs hand back nothing, from the page re-fetching its own stylesheets at the addresses it already linked. Those are the only requests CompatLens causes, they are made by the page rather than by the extension, they usually come straight out of the HTTP cache, and you can watch them in the Network panel.

What it reads: the page's rendered markup (via a MutationObserver, drained every 750ms), the page's address at drain time (location.href), and stylesheet bodies (via chrome.devtools.inspectedWindow.getResources and, as a fallback, the page fetching its own linked stylesheets). CompatLens does not read cookies, localStorage, sessionStorage, request or response headers, request bodies, authentication tokens, browsing history, or JavaScript sources.

What it keeps: markup and CSS are parsed in a Web Worker and dropped the moment findings come out. What survives is the finding itself (feature, risk level, location, affected browsers, fallback text, MDN link) and session state (routes seen, addresses read, warnings). All of it lives in the panel's memory only. Nothing is written to chrome.storage, nothing is written to disk, nothing survives the panel closing. The one exception is Export .md, which builds a Markdown report and hands it to the browser's own download, at your request.

What leaves the machine: nothing. Compatibility data is compiled into the extension at build time from pinned versions of @mdn/browser-compat-data, web-features and baseline-browser-mapping, so a scan needs no network access at all. The only requests that can leave the machine are the page re-fetching a stylesheet or source map it already loaded (reaching only the site you were looking at), and you clicking an MDN link, which opens with rel="noreferrer noopener".

Permissions: neither manifest requests any. No permissions key, no host_permissions, no <all_urls>.

Full source and the complete privacy documentation, with file references for every claim above, are at https://github.com/Faran52/compatlens/blob/main/docs/privacy.md