Privacy Policy — Mobile Simulator

Last updated: 2026-06-12

Extension: Mobile Simulator (Chrome Web Store)

Mobile Simulator is a Chrome extension that lets web developers preview any

URL on multiple device frames (iPhone, Galaxy, Pixel, iPad) side by side

inside one Chrome tab. This document explains what data the extension

processes and what it does not.

1. We do not sell or share your data

We never sell, rent, license, or otherwise share any data with third

parties beyond what is described in this document. There is no advertising,

no profiling, no cross-site tracking.

2. Data the extension processes locally

The following is processed on your computer only, in chrome.storage.local,

and is never sent to our servers:

• Your simulator session. The list of device panels you have open, their

device IDs, orientations, dark-mode states, and current zoom level. Saved

so you can close and re-open the tab without losing your layout.

• Settings. Toggle states (PWA mode, sync scroll, keyboard overlay,

theme, etc.) and your custom device definitions, if any.

• A locally-generated random identifier (UUID). See section 4 below.

You can clear all of this at any time from Chrome's extension settings

(chrome://extensions → Mobile Simulator → Site data → Clear).

3. Browsing-target data the extension touches

To make the iframe rendering work, the extension reads and modifies HTTP

headers on requests to the URL you preview. Specifically:

• Removes X-Frame-Options, Frame-Options, Content-Security-Policy,

and Content-Security-Policy-Report-Only response headers, so the URL

can be displayed inside an iframe.

• Spoofs the User-Agent request header (and the matching sec-ch-ua* client-hint headers) to present the simulated device

(e.g., iPhone Safari) so the target site serves its mobile layout.

These modifications are scoped to the single Chrome tab running the

simulator. They use Chrome's declarativeNetRequest API, which processes

the rules natively inside Chrome — the extension does not see request or

response bodies, cookies, or page content.

The extension does not read, store, or transmit:

• The URL you preview, its hostname, or its content.
• The page title, body, or DOM of the previewed site.
• Cookies, localStorage, sessionStorage, or IndexedDB of the previewed site.
• Form input, scroll position, or interaction events inside the previewed

iframe.

4. Anonymous usage analytics (enabled by default, one-click disable)

Mobile Simulator includes anonymous-usage analytics that help us

understand which features are most valued and where to invest time. It

is enabled by default so that we can see how the extension is used

across the install base. You can disable it at any time via the

"Help improve Mobile Simulator" toggle in the extension's sidebar

(Display group). Disabling is immediate — one final

analytics_opt_in_changed event records the choice, then no further

events leave your computer.

What is collected when opt-in is ON

• A random identifier. A UUID generated locally at first install

(crypto.randomUUID()), stored in chrome.storage.local. It is not

linked to your Chrome profile, your Google account, your email, or your

IP address.

• Feature-name events. When you take an action like switching device,

rotating, taking a screenshot, or loading a preset, the extension sends

the name of that action (e.g., device_changed, screenshot_captured,

preset_loaded) plus a minimal, non-identifying payload. The full

schema of every event type is published in

docs/ANALYTICS_EVENTS.md.

• Aggregate device metadata. Operating system family (Mac /

Windows / Linux / ChromeOS), browser locale (en-US, ru-RU,

…), and extension version.

• Redacted error reports. When an internal error is caught, a

truncated 200-character message is sent. URLs, file paths, and email

addresses are automatically replaced with [URL] / [PATH] / [EMAIL]

placeholders before transmission.

What is NEVER collected — even when opt-in is ON

• URLs of websites you preview, their hostnames, or any part of their

content.

• The text of search queries you type in the device picker (only the

string length).

• The names you give to custom devices.
• Your IP address. PostHog, our analytics provider, strips the IP at the

server boundary (anonymize_ips=true setting on our project).

• Your email, your name, or any account credentials.
• Cookies of any kind.

Analytics provider

Anonymous events are sent to PostHog (https://posthog.com), an

open-source product analytics service. Our project is hosted on PostHog

Cloud US (https://us.posthog.com). PostHog's own privacy practices are

described at https://posthog.com/privacy.

4a. Feedback forms (user-initiated, not automatic)

The extension includes a Send feedback button (sidebar → Settings →

Tools) that opens an in-extension form with three categories: report a

bug, suggest an improvement, or request a device. Submissions are

user-initiated — the form never sends anything automatically.

What is sent when you submit a feedback form

• The message you typed.
• An optional email address — only if you provide one because you want a

reply.

• Metadata: extension version, operating-system family (Mac / Windows

/ Linux / ChromeOS), browser locale, the active device name and

viewport size (e.g. iPhone 17 Pro Max (440×956)), the number of open

device panels.

• The same anonymous random identifier described in §4 — **only if

anonymous analytics is enabled**. Lets us correlate a report with the

events from that install (e.g. "this report came from someone who saw

the screenshot error this week"). If you've disabled analytics, the

identifier is dropped before transmission.

What is NEVER sent with a feedback form

• The URL of the website you were previewing.
• The hostname, page title, or content inside the iframe.
• Names you gave to custom devices.
• Search queries from the device picker.
• Your IP address (the Cloudflare Worker may see it transiently at the network layer for spam protection;

it is not stored in the message we receive).

Feedback delivery pipeline

Submissions are sent over HTTPS to a small Cloudflare Worker

(*.workers.dev) under our control. The Worker validates the request

came from a Chrome extension and forwards the message to a private

Telegram chat via the Telegram Bot API. Nothing is stored — the Worker

holds no database, and the only delivery destination is the developer's

Telegram. Cloudflare's privacy practices are described at

https://www.cloudflare.com/privacypolicy/, Telegram's at

https://telegram.org/privacy.

Spam protection

The submit button is disabled for 2 seconds after the form opens to

discourage automated submissions. The Worker additionally rejects any

request whose Origin header is not a Chrome extension.

How to turn it off

Open the extension, scroll to the Display section in the sidebar,

and toggle "Help improve Mobile Simulator" off (the toggle ships

checked on; one click disables it). The act of disabling fires one final

analytics_opt_in_changed event with enabled=false and then no further

events are sent. You can also clear the stored random identifier by

uninstalling the extension or by clearing site data in

chrome://extensions.

4b. Uninstall feedback page (on our website, not in the extension)

When you remove Mobile Simulator, Chrome opens a short feedback page at https://mobile-simulator.com/uninstall in a new tab. This is a normal web page on our own website — it is not part of the extension and has no access to your browser or your data. Closing the tab sends nothing beyond the single page-load signal described below.

What the page sends

• On page load — one anonymous event (extension_uninstalled) recording that an uninstall happened, with: the extension version and your browser's UI language. This is the same kind of anonymous, aggregate signal described in §4.
• Only if you submit the survey — a second event (uninstall_survey_submitted) with the reason you selected and any free-text you chose to type. The survey is entirely optional; if you close the tab or click "No thanks", no free-text is sent.
• The same anonymous random identifier described in §4 — included in the page URL only if anonymous analytics was enabled in the extension at the time of uninstall. If you had disabled analytics, no identifier is passed and the answer cannot be linked to anything.

Notes

The free-text fields could contain whatever you type, so please do not enter sensitive information. Anything submitted is used only to improve the product and is stored by PostHog under the same terms as §4. No cookies, no consent banner — the same opt-out model that governs the extension applies here. The page also uses Cloudflare Web Analytics (cookieless) for basic traffic counts.

5. Permissions justification

The extension requests the following Chrome permissions. Each is used

strictly for the feature next to it; no permission is used for any other

purpose.

5a. Data retention

The anonymous usage events are retained by our analytics provider (PostHog) for the duration of our project's standard retention window and are used only in aggregate. Because they carry only a random identifier and no personal data, they cannot be traced back to you. Feedback-form submissions are delivered to a private channel and are not stored in any database by the extension; we keep them only as long as needed to act on the feedback. The locally stored settings (chrome.storage) live on your own device and are removed when you uninstall the extension or clear its data.

5b. Children

The extension is a developer tool intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If you believe a child has provided us information, contact us (section 7) and we will delete it.

6. Changes to this policy

We may update this policy when we add features. Any update will be

reflected in this file inside the extension repository, and the

"Last updated" date at the top will change. Material changes (new data

categories, new third parties) will be called out in the extension's

release notes on the Chrome Web Store listing.

7. Contact

Questions, concerns, or requests to delete the anonymous identifier

associated with your extension install:

• Email: [email protected]
• GitHub: https://github.com/awens84/mobile-simulator/issues

8. Open source

Mobile Simulator is licensed under MIT and developed in the open. You can

audit the exact code that processes your data:

• Repository: https://github.com/awens84/mobile-simulator
• Analytics module: src/sim/analytics.js
• Event schema (canonical contract): docs/ANALYTICS_EVENTS.md
• DNR rules: src/background/index.ts