Privacy Policy for XML Toolbox by XML ValidatorBuddy

1. Scope

This policy applies to the XML Toolbox by XML ValidatorBuddy Chrome extension and explains the information processed by the extension and Web API.

2. Information processed

XML content

The extension processes XML only after the user loads it from the active tab, pastes it, or selects a local .xml file and then explicitly runs a tool. Anonymous requests are limited to 10 KiB (10,240 bytes). The extension does not read pages in the background.

Connection metadata

Standard server access logs may record operational metadata such as IP address, timestamp, endpoint, user agent, and response status. Request bodies containing XML are not included in standard access logs.

3. How information is used

XML content is used only to return the formatting, well-formedness, or signature-integrity result selected by the user. Connection metadata may be used to operate, secure, and troubleshoot the service and prevent abuse.

Signature verification checks supported reference-digest and signature-value integrity. It does not evaluate certificate trust, signer identity, certificate-chain validity, or revocation.

4. Storage and retention

• Submitted XML: Processed for the request and not retained as application data or intentionally written to application logs.
• Results: Stored by the extension only in Chrome session storage and cleared with the browser session. Files downloaded by the user are under the user's control.
• Consent preference: A boolean recording acceptance of the disclosure is stored locally in the Chrome profile and contains no XML.
• Server access logs: Retained only as reasonably necessary for security, abuse prevention, troubleshooting, and reliable operation.

5. Sharing and disclosure

XML is transmitted only to the XML ValidatorBuddy Web API and infrastructure providers operating that service on our behalf. It is not sold, licensed, supplied to advertising networks, or shared for unrelated purposes.

Information may be disclosed if required by law or necessary to protect the security and integrity of the service.

6. Chrome permissions

• activeTab: Lets the user request XML text from the active tab.
• scripting: Reads XML text from that tab only after the user selects the command.
• storage: Holds results for the browser session and remembers the consent preference.
• api.json-buddy.com: Sends selected XML to the chosen Web API endpoint over HTTPS.

7. Security

XML is transmitted using HTTPS. Formatted XML is rendered as plain text, not live markup. The extension loads no remotely hosted executable code and neither requests nor stores API keys.

8. User choice and local processing

The extension asks for consent before sending the first request. A user can avoid transmission by not running a tool or by removing the extension.

9. Chrome Web Store Limited Use

Information received through Chrome APIs is used only to provide the extension features described here. Our use of that information complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

10. Changes to this policy

If the extension's data practices change, this policy and the extension disclosure will be updated before those changes take effect.