Effective date: October 20, 2026
Developer: Culprit ยท Contact: business.movecurious@gmail.com
Culprit is a Chrome extension that helps you find which click caused a failed network request or console error, find reliable test selectors, and write bug reports. This policy explains, in plain language, what it does with data.
When you switch Culprit on for a website (its domain and subdomains), it watches that website's tabs, including the website's own embedded frames (iframes), and records, locally:
Redaction. Before anything is stored, Culprit replaces the values of sensitive items with [REDACTED]: headers that carry credentials (Authorization, Cookie, API-key, token and similar); fields whose name means a secret (password, token, secret, API key, card number, SSN, signature, OAuth code verifier and similar, in any spelling) in JSON, forms and URL query, fragment or path parameters, including the signature of a signed URL (for example sig, X-Amz-Signature, X-Goog-Signature and CloudFront Signature); key=value and key: value pairs inside any text (console messages, error pages, web addresses, queries); JSON or forms held inside a text value; secrets hidden inside values, such as Bearer or Basic credentials, JSON Web Tokens, cloud API keys, private keys and passwords inside web addresses; real payment card numbers and IBANs; a credential word followed by a long value in free text (for example "token 9f3Kx0aQ..."); plus extra field names you add in Settings. You can turn redaction off in Settings. Redaction runs twice: first inside the page, then again in Culprit's own background process, under your real settings, just before anything is stored.
Culprit records whatever the sites you enable send and receive. It does not choose or classify the content of a failed request or response, so that content may include any kind of personal or sensitive data your site handles: for example names, contact details and other personal information, account or payment details, health information, messages and other personal communications, location, login or session data, and the text and links of pages. All of it stays on your device (see Storage below) and none of it is transmitted by Culprit.
Known limits of redaction. It is best effort and it works by recognising names and shapes, so it cannot find everything. It does not remove personal data such as names, email addresses, phone numbers or addresses. It cannot recognise a secret in free text that has no key word before it, and it leaves values under generic names such as key, state, ticket, code or pin readable, because hiding them would also hide ordinary debugging evidence. The visible text of an element you click is recorded as its name. Screenshots are plain pixels and are not redacted. Review a report before you share it.
A page you record can see its own traffic. Culprit watches a page from inside that page, where the site's own scripts (and any third-party script on it) also run. Such a script can already read that page's requests and responses. It can also tell Culprit to stop recording that page's activity, which hides that activity from Culprit. It cannot turn off the second redaction pass in Culprit's background process, but that pass uses the same recognition rules, so the limits above apply to both. Culprit does not claim to protect data from scripts that run on the page itself.
Storage.
chrome.storage.session) for that tab. They are dropped when the tab or the browser closes, when you press Clear, or when you switch the site off: "Disable" on a site stops recording on it and deletes what was recorded on that site, in every tab (what other sites recorded is kept). Each tab keeps only its most recent events.chrome.storage.local until you change them, disable the site, or remove the extension.Your actions. Culprit copies text to your clipboard, or saves a JSON file, only when you ask: a copy or export button, or the keyboard shortcut for "copy the bug report" (Alt+Shift+C by default). "Check these on the page now" counts how many elements each selector matches in the page you are looking at; it only reads, changes nothing and keeps nothing. The Screenshot button (or the keyboard shortcut Alt+Shift+S) captures the visible part of the current tab as an image and shows it in Culprit's side panel, where you can copy it or open it in a tab. The popup's camera button copies it straight to your clipboard (or saves a PNG file). Screenshots are not redacted, because they are plain pixels: check one before you share it. While a screenshot is on its way to the panel it is held briefly in the browser's session storage (until the panel shows it, the page navigates, the tab closes, or two minutes pass). It is never added to the recorded events, the bug report or the JSON export, and Culprit does not keep it afterwards. What you do with copied text or files afterwards is up to you.
Culprit's use of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. The data above (including the addresses of pages and requests, which Culprit needs to pair each failure with the click that caused it) is used only to provide and improve Culprit's single purpose, is never sold or transferred, is never used for advertising, creditworthiness or lending, and is never read by a person unless you copy or share it yourself.
Why Culprit asks for each browser permission is listed in the Chrome Web Store listing and in the project's store/permissions.md. In short: site access is requested per site, only when you press Enable recording.
"Notify on failure" is off by default and its browser permission (notifications) is optional: Chrome asks for it only when you switch the setting on, and Culprit gives it back when you switch it off. With it, Culprit shows a local desktop notification (the status, method and path of the failed request) when a request fails on a site you enabled. Nothing is sent anywhere.
Culprit is a developer tool and is not directed at children.
If this policy changes, the new version and its date will be published at the same address. If a future version ever needed to handle data differently, the listing and this policy would be updated before release.
Questions, bug reports and feature requests: use the Support section of the Culprit page on the Chrome Web Store, or write to business.movecurious@gmail.com. Culprit itself has no feedback form and sends nothing.