Privacy Policy
Last updated: September 30, 2026
Fluxframe is a browser extension for capturing and inspecting WebSocket message streams. This policy explains what information it handles and how it is used.
Information Fluxframe handles
- Account information: your email address and password when you create an account or sign in. The authentication service stores the email and a salted, one-way password hash; it does not store your password in plain text.
- Sign-in session: an authentication token and email are kept in the browser extension’s local storage so you can remain signed in. The service stores a hash of the token. Sessions expire after seven days and can be revoked when you sign out.
- Captured stream data: when you arm capture for a target, Fluxframe records WebSocket message contents and related details such as direction, endpoint, connection information, timestamps, and the page URL. Message content can contain information supplied by the site or service you are inspecting.
- Service request information: the authentication service may process your network address and basic request details to rate-limit sign-in attempts, protect the service, and troubleshoot errors.
Where information is stored
Captured messages, saved targets, and extension preferences are stored locally in your browser profile. Fluxframe retains up to the newest 3,000 capture events, subject to a local storage size limit. You can clear captured messages from the message viewer. Captured message contents are not sent to Fluxframe’s authentication API.
Account email addresses, password hashes, and session-token hashes are stored by the Fluxframe authentication service on its hosted server. Sign-in requests are sent over HTTPS. Authentication-service hosting and network providers may process the information needed to deliver and secure that service.
How information is used and shared
Fluxframe uses account information to create and secure your account, and uses captured data only to provide the extension’s capture, display, search, and export features. Fluxframe does not sell captured content or use it for advertising. Captures remain in your browser unless you choose to copy or export them or otherwise share them.
Your choices and retention
You choose whether to arm capture and which saved target to use. You can clear locally stored messages in the viewer and sign out to revoke your session. Local captures are limited to the newest 3,000 events and a storage-size cap. Account information is kept while your account is active. To request account deletion or ask a privacy question, contact the publisher using the contact email shown on the Fluxframe Chrome Web Store listing.
Security
Fluxframe uses HTTPS for communication with its authentication service, salted password hashing, and hashed session tokens. No method of storage or transmission is completely secure, so capture only streams you are authorized to inspect and handle exported data carefully.
Changes to this policy
This policy may be updated when Fluxframe’s functionality or data practices change. The latest version and its effective date will be available at this page.