← Back to MMRequest

Privacy Policy

Last updated: May 23, 2026

MMRequest is a Chrome extension that helps developers test multimodal HTTP APIs by automatically base64-encoding media (images, audio, video) into request bodies. This policy describes what data MMRequest collects when you choose to sign in, and how we use it.

1. What we collect

We collect data only when you voluntarily click "Get started with Google" and complete sign-in. If you never sign in, MMRequest collects nothing on our servers.

When you sign in, we store the following in our database (Supabase, hosted in the Northeast Asia region):

• Your Google account email address
• Your Google user ID (the sub claim from your OAuth token)
• The timestamp of your first sign-in (signup_at)
• The timestamp of your most recent activity (last_seen_at)
• Sign-in and sign-out events: timestamp, your browser User-Agent string, and the extension version

That's it.

2. What we do NOT collect

The core function of MMRequest — composing and sending HTTP requests, including images, audio, video, headers, request bodies, and API responses — happens entirely in your browser. The following information never leaves your machine:

• The URLs you call (your API endpoints)
• Request bodies, headers, authentication tokens, or query parameters
• Images, audio, video, or other media you attach
• API responses
• Your browsing history, other tabs, or any data from sites you visit
• Your IP address — we don't log it; Supabase may log it transiently for abuse prevention but does not retain it for our use

3. Why we collect what we collect

We collect the minimum required to:

• Identify you as a returning user across devices and browsers
• Determine eligibility for our Early Adopter benefit: users who signed in before a future cutoff date will retain free access to all features after we introduce paid plans. The signup_at timestamp is the basis for this determination.
• Provide diagnostic context for sign-in problems via the sign-in / sign-out event log

We will never sell your data, share it with advertisers, or use it for any purpose other than the above.

4. Third-party services

Sign-in is mediated by two third parties:

• Google (OAuth provider) — handles authentication. Subject to Google's Privacy Policy.
• Supabase (database & authentication backend) — stores the data listed in §1. Subject to Supabase's Privacy Policy.

We do not share data with any other third parties.

5. Data retention and deletion

Your data is stored until you request deletion. To delete your account and all associated data, email us (see §9) with the subject line "MMRequest data deletion" from the email address you signed in with. We will delete your records within 7 days.

You can also sign out at any time from the extension — this stops new sign-in events from being recorded, but does not delete your existing data. Use the deletion request flow above to fully remove your data.

6. Your rights

You have the right to:

• Access the data we have about you (email us — see §9)
• Correct any inaccurate data (sign out and sign in again)
• Delete your account and data (see §5)

If you are in a jurisdiction with specific data-protection laws (GDPR, CCPA, etc.), you retain all rights granted by those laws.

7. Children

MMRequest is intended for software developers and is not directed at users under 13. We do not knowingly collect data from children under 13.

8. Changes to this policy

If we update this policy, we will revise the "Last updated" date at the top of this page. Material changes will be announced inside the extension before they take effect.

9. Contact

For privacy questions, deletion requests, or any concerns, email: rex.leto.addib@gmail.com