Brace Lens privacy policy

Effective date: 8 November 2026

This policy covers the Brace Lens browser extension (“Brace Lens”), published by Matheus Mello, an individual developer based in Portugal. Contact: matheus.mello.developer@gmail.com.

Summary

• Brace Lens does not collect, transmit, sell or share document contents, page addresses or searches. Processing takes place in your browser.
• There are no accounts, analytics, telemetry, advertising, affiliate links, backend, remote configuration or remotely loaded code.
• The extension itself makes no network requests. Opening a web address in JSON or the privacy link by clicking it is ordinary browser navigation to that site, which may receive normal connection data and apply its own privacy policy.

Automatic detection and page access

Automatic viewing is on by default. A small detector runs at document start on pages where the browser permits site access. It checks the document content type and structure, and reads a bounded opening prefix on raw-text candidates. Ordinary structured web pages are rejected without reading their text. Recognised JSON and JSON Lines documents are read, parsed, filtered and displayed locally. Undeclared text must begin with an object or array; other values can be opened in the paste workspace. Turning automatic viewing off prevents viewer injection on subsequent loads; the detector can still perform its local checks.

Browser-protected pages, downloaded responses and pages without site access may prevent automatic viewing. Chrome and Edge require “Allow access to file URLs” for local files. Firefox has no equivalent switch; its HTTP(S) header hook does not apply to file URLs. Use the paste workspace for local files shown in Firefox’s protected JSON viewer or responses downloaded as files.

Firefox response-header compatibility

Firefox alone uses webRequest and webRequestBlocking to examine response headers for top-level HTTP(S) document navigations. When automatic viewing is enabled, a response with one eligible JSON or JSON Lines Content-Type (including supported vendor JSON types) is relabelled text/plain before Firefox selects its built-in viewer. Existing parameters, including an explicit charset, are preserved; UTF-8 is added when no charset is declared. Firefox’s JSON viewer preference is not changed.

Attachment downloads, responses with multiple Content-Type headers, other content types, subframes and fetch/XHR responses are left unchanged. Only the eligible response’s Content-Type is changed: the original body is used directly, without interception, refetch or a new request. Request headers are not modified.

The setting is read for each eligible response. When automatic viewing is off, or reading the setting fails, no header change is made. A successful read with no saved setting defaults to on. Turning it off does not undo a response already displayed. The current JSON navigation URL, without its fragment, is held only in background memory per tab to match the detector to its document. It is cleared on the next top-level response handled by the hook, tab close or background restart; stale asynchronous decisions are discarded. It is not written to persistent storage or transmitted.

Chrome and Edge request neither of these webRequest permissions and do not perform this response-header handling.

Workspace, console and clipboard

JSON you paste, drop or open from a file in the paste workspace stays in that tab’s memory until you close or reload it. Documents and original page text used by the viewer are not saved to persistent extension storage.

On a successfully rendered JSON page, a lazy window.braceLens getter makes the parsed document available in the page’s DevTools console and to scripts running in that page. Those scripts could already read the original text, which remains in the document. The getter parses that text when accessed and exposes data only, with no extension API or messaging bridge. The paste workspace also exposes its current valid document as braceLens. Console parsing uses native JavaScript numbers, which can round precise values.

The extension writes to the clipboard only when you choose a copy action and never reads the clipboard. Copied data is then subject to your system’s clipboard handling.

What is stored on your device

Only two preferences are saved in storage.local in this browser profile: theme (system, light or dark) and whether automatic viewing is enabled. They are not synced and are removed when you uninstall the extension. Documents, page addresses, searches and copied values are never written to persistent extension storage.

Permissions

storage saves those preferences. scripting injects the bundled viewer into recognised JSON documents and the console getter into the page’s main JavaScript world. All-site host access (<all_urls>) and the all-site content script allow automatic detection at any supported address, subject to browser restrictions and your site-access settings. In Firefox, that host access also permits the navigation-header handling described above. Firefox alone requests webRequest and webRequestBlocking; neither build requests response-body filtering or browser-settings access.

Sharing

I receive no data from the extension, so nothing is sold, shared or used for advertising.

Your rights and changes

If you email me, I use your message only to reply, and you may ask me to delete it. Under the GDPR you can also complain to the Portuguese data protection authority (CNPD). If this policy changes, the new version will be posted here with a new effective date.