Privacy Policy
Last updated: 16 October 2026
1. Who we are
Placebo API (the Chrome extension and placeboapi.com) is operated by Individual Entrepreneur Denis Okunev, "we" or "us". We are the controller of the personal data described here. For anything about your data, write to support@placeboapi.com.
2. Data that stays on your device
Your rules, folders, response bodies and settings are stored in your browser's extension storage
(chrome.storage.local). They are not sent to our servers, and we can't see them. Exported files are
saved wherever you choose. Uninstalling the extension deletes this data from the browser.
The extension needs access to http and https pages so your rules can apply to the sites you test. To apply them, it checks the address and method of requests against your rules. This happens only in your browser: the extension doesn't collect, store or send page content, the addresses you visit or your browsing history.
The extension also passes the active rules to the pages you visit, inside your browser. Scripts on those pages could technically read them, so don't put secrets such as passwords or tokens into rules.
3. Data we process
An account is optional. Without one, the extension works with smaller limits and contacts no server of ours. To create an account you have to give your email address; we can't provide an account without it.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | To sign you in with a one-time code and to contact you about your account or purchases | Performance of a contract (Art. 6(1)(b)) |
| Account identifier, sign-in sessions and their timestamps | To keep you signed in and to tell the extension which plan you have | Performance of a contract |
| Plan and subscription details (plan, status, renewal date, the reseller's subscription ID) | To apply the limits of your plan | Performance of a contract |
| Technical logs (IP address, browser type, time of request) kept by our hosting providers | To keep the service secure, prevent abuse and fix errors | Legitimate interests (Art. 6(1)(f)): keeping the service secure and working |
| Messages you send to support (your email address and what you write) | To answer you | Legitimate interests in replying to you, or performance of a contract when it's about your account |
| Sales and payout records from our reseller | Bookkeeping and taxes | Legal obligation (Art. 6(1)(c)) |
About once a day, the extension asks our server for your current plan. That request carries only your sign-in session, no browsing data. We don't rely on consent for any processing, and we make no decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
4. Payments
Paid plans are sold by our reseller, Paddle.com, which is the merchant of record. It collects your payment details, billing address and tax information as an independent controller, under its own privacy policy. We never receive your full card details. From the reseller we receive what we need to give you your plan and keep our books: your email address and name, your country and, where you give them, your address and tax ID, the plan you bought, the amounts, and the subscription's status and dates.
5. The website
placeboapi.com sets no cookies and uses no analytics or advertising trackers. Like any website, its host (Cloudflare) processes your IP address to deliver pages and protect against attacks.
6. Who else processes data
We use these providers to run the service. They process data on our behalf under data processing agreements, except our reseller, which acts as a separate controller.
| Provider | Purpose | Where | Transfer safeguard |
|---|---|---|---|
| Supabase (Singapore) | Accounts, sign-in and plan database | Database hosted in the EU (Frankfurt, Germany); Supabase and its sub-processors may access it from outside the EEA | Standard Contractual Clauses |
| Resend (USA) | Sending sign-in code emails | USA (emails are sent from the EU) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare (USA) | Website hosting, DNS and forwarding of support emails | Global network | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Google (USA) | The mailbox where support emails arrive | USA and other countries | EU-U.S. Data Privacy Framework |
| Paddle.com | Payments, invoices and sales tax (merchant of record, separate controller) | See its privacy policy | |
You can ask us for a copy of these safeguards.
7. How long we keep data
- Account data: until you delete your account.
- Support messages: up to two years after the conversation ends.
- Technical logs: only for the short periods our providers keep them, usually days and at most a few weeks.
- Sales and payout records: as long as tax law requires. The reseller keeps its own records under its policy.
You can delete your account at any time in the extension (Account tab, Delete Account). This removes your account, profile and plan records from our database straight away. Your rules stay in your browser.
8. Your rights
Depending on where you live (for example under the GDPR), you can ask us for a copy of your data, and ask us to correct it, delete it, restrict its use or send it to you in a portable format.
Right to object: where we rely on legitimate interests, you can object at any time on grounds relating to your situation, and we'll stop unless we have compelling legitimate grounds to continue.
Write to support@placeboapi.com. We reply without undue delay, normally within 10 working days and never later than one month. You can also complain to a data protection authority: the one where you live or work in the EU or EEA, the State Audit Office of Georgia, or Serbia's Commissioner for Information of Public Importance and Personal Data Protection.
9. Chrome Web Store User Data Policy
The use of information received by the Placebo API extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use data only to provide and improve the extension's single purpose. We don't sell it, don't use or transfer it for advertising, credit-worthiness or lending, and don't let people read it unless you explicitly agree for specific data, it's needed for security, or the law requires it.
10. Children
Placebo API is a tool for software developers and isn't directed at children under 16. We don't knowingly create accounts for them; if you think a child has an account, tell us and we'll delete it.
11. Changes
We'll update this page when our practices change and change the date at the top. For significant changes, we'll tell account holders by email before they apply.