Privacy Policy

Last updated: 2026-08-23

PostHog Debugger is an unofficial browser DevTools extension for inspecting how a page uses PostHog. It is not affiliated with, endorsed by, or sponsored by PostHog.

Summary

The extension processes captured debugging data locally in the browser and does not send it to the developer or to a developer-controlled remote service. A user can optionally connect a PostHog Cloud account for bounded, read-only project context. Signed-out capture and debugging remain fully available.

Data the Extension Can Inspect

When DevTools is open, the extension can inspect PostHog-related event names and properties, request URLs and status, payloads, selected flag responses, distinct IDs, session IDs, replay URLs, SDK configuration, frame origins, and local validation warnings. If a site includes personal or sensitive values in a PostHog payload, those values can appear in the local DevTools panel.

How Data Is Used

Inspected data is used only for debugging features: live event inspection, payload decoding, network health, feature-flag and session state, validation warnings, autocapture preview, and local lint reports. When the user connects a PostHog Cloud account, authenticated metadata can add project names and links, Web Script summaries, feature-flag and experiment context, replay existence, event/property definitions, declared-type linting, and exactly correlated ingestion warnings.

Optional PostHog Authentication

Choosing Connect PostHog starts an OAuth Authorization Code flow with PKCE through oauth.posthog.com. The extension is a public client with no client secret. It supports PostHog Cloud in the US and EU and requests only these scopes:

• openid, profile, and email;
• organization:read and project:read;
• hog_function:read, feature_flag:read, and experiment:read;
• session_recording:read, event_definition:read, property_definition:read, and ingestion_warning:read.

Access tokens stay only in background-worker memory. The rotating refresh token and an optional sanitized account name/email summary are stored in trusted local extension storage, not synchronized storage. Pending PKCE state is kept only in transient extension session storage. Credentials are never exposed to the DevTools panel, popup, inspected page, exports, or extension usage analytics.

After authorization, the background worker reads the account's organizations and projects from the authenticated US or EU region and matches observed public project tokens locally. For a selected project, it can request:

• Hog Function metadata only for known Web Script runtime IDs;
• feature-flag metadata only for exact observed keys and experiments associated with those flags;
• recording existence only for a valid observed session UUID, without downloading or embedding replay content;
• event and property definitions only for observed names, without property values; and
• recent ingestion-warning samples without captured-data filters, followed by local exact-event-UUID correlation.

The extension does not request person profiles. It does not send captured event payloads, property values, inspected URLs, distinct IDs, identities, or replay contents through authenticated APIs. Warning details and distinct, person, and group identifiers are removed in the background worker; unrelated warning samples are not returned to the panel or retained in the authenticated cache.

Local Processing and Storage

Captured data is stored in memory while DevTools is open. The extension does not persist captured analytics payloads in extension storage, IndexedDB, or a remote database. LocalStorage can hold UI preferences and user-provided tracking-plan JSON. Closing DevTools, navigating, reloading, or choosing Clear removes the in-memory debug view.

Trusted local extension storage can also hold a non-identifying onboarding state and, after optional authorization, the rotating refresh token, optional sanitized account summary, exact public-token-to-project selections, and bounded authenticated metadata summaries. Organization/project, Web Script, flag/experiment, replay-existence, definition, and ingestion-warning caches have a 15-minute hard expiry. Disconnect, logout, or credential revocation clears credentials, authenticated metadata, and saved project mappings.

Data Sharing

The extension does not sell, share, transfer, or transmit inspected analytics or browsing data to the developer. Signed-out diagnostics observe requests the inspected site is already making. Optional authenticated enrichment sends only the limited runtime identifiers and names described above to the user-selected PostHog Cloud project for read-only lookup. No captured payload values, inspected URLs, identities, or replay contents are transmitted by that feature.

Extension Usage Analytics

The extension can send limited, cookieless usage events containing only allowlisted interaction categories, count buckets, version, browser, build variant, and optional internal debug markers. They do not contain inspected URLs, event names, properties, payloads, distinct IDs, or inspected flag keys.

OAuth connect/disconnect actions, authorization outcomes, account status, project discovery and mappings, authenticated metadata loads, authenticated resource identifiers, account details, granted scopes, and failure categories do not emit extension usage events.

Usage analytics uses a random in-memory session ID, disables autocapture and session recording, and ends with the DevTools panel. Firefox analytics and feature-flag evaluation start only after optional technical and interaction-data permission is granted.

Remote Code and Permissions

The extension does not load or execute remotely hosted extension code. Its pages and content script run from packaged files. The content script can run on HTTP and HTTPS pages, including iframes, because PostHog can be used on arbitrary websites, staging environments, embedded widgets, localhost tunnels, reverse proxies, and self-hosted setups.

The optional identity permission starts the user-requested OAuth flow. The storage permission keeps the local state described above. Fixed access to oauth.posthog.com, us.posthog.com, and eu.posthog.com is used only for OAuth and authorized read-only PostHog Cloud API requests. Self-hosted and arbitrary authenticated API hosts are not supported.

Limited Use Statement

Inspected data is used only for user-facing PostHog debugging. It is not used for advertising, profiling, resale, credit worthiness, or unrelated purposes.

Contact

For privacy questions or support, email gevorg@glechyan.com.

Return to the PostHog Debugger product page or documentation for installation and debugging guidance. The GitHub repository and complete changelog provide the canonical source and release history.