Sourcemap Explorer
Privacy

Privacy policy

Sourcemap Explorer is a local-first browser extension. The detection, decompile, and stack-identification pipelines run entirely inside your browser. There is no backend, no analytics SDK, no user-account system. This page is the formal explanation of what that means in practice.

Last updated: 2026-05-08

The browser extension

When you install Sourcemap Explorer from the Chrome Web Store, the permissions you grant are the minimum needed for it to work:

  • activeTab— required to read the source of the tab you click the icon on. The extension cannot read tabs you have not explicitly opened it on.
  • scripting— required to run the detection pipeline against the page’s JavaScript and HTML that your browser already loaded.
  • storage— required to cache the extension’s own indexes (Wappalyzer fingerprint database, decompile worker state) on your local disk so the popup is fast. No browsing data is stored.
  • offscreen— required to host a hidden document where Babel and the decompile worker run without freezing the popup UI.

The extension does not request host permissions for sites you have not opened it on, does not use the tabs API to enumerate your open tabs, and does not register a background content script that runs on every page you visit. The popup is the only entry point.

What is sent over the network

The extension makes network requests in only two narrow cases, both initiated by you and both directed at servers that are not owned or operated by us:

  • The page’s own assets. When you trigger detection on a tab, the extension may fetch source-map files from the same origin the browser already loaded the page from. These requests go to the site you are inspecting, not to us.
  • Public package metadata. When the stack pipeline recognises an npm package by file path, it may query the public npm registry (registry.npmjs.org) to surface the latest version, license, and homepage. When it recognises a WordPress plugin, it may query api.wordpress.org for the same kind of metadata. These requests carry no identifier beyond what your browser sends to any other public API: a User-Agent string and your IP. We do not see them; the registries do, subject to their own privacy policies.

That is the complete network footprint. There is no “phone home” ping on install, on update, or on every popup open.

The landing site (this website)

The pages under source-map.mapree.dev are statically generated by Next.js. The site does not use any first-party analytics SDK (no Google Analytics, no Plausible, no Mixpanel, no PostHog). The web server records standard HTTP access logs (timestamp, IP, requested URL, User-Agent, referer) to detect abuse and debug outages; those logs are rotated and not joined to any other dataset.

The /stack/* catalogue pages display Google AdSense ads. AdSense uses cookies and may collect data subject to Google’s own privacy policy. You can opt out of personalised advertising via Google’s ads settings or by using a browser-level tracking protection feature. The remaining pages on the site do not run AdSense.

The contact form on the homepage uses the email address you submit for one purpose only: to reply to your message. We do not add it to a mailing list, do not enrich it with third-party data, and do not share it with anyone. If you would like the message and email removed after we’ve responded, ask in the same thread and we will delete it.

Cookies

The site itself sets no first-party cookies. The Chrome Web Store link is a plain anchor; clicking it leaves the site. The AdSense integration on /stack/* pages may set Google’s cookies in your browser, scoped to Google’s domains and not readable by us.

Your rights (GDPR, CCPA, and equivalents)

Because the extension does not collect personal data and the site collects only the email you choose to send to the contact form, most data-protection rights are trivially satisfied. You can:

  • Request access or deletion of any contact-form email by replying to the original message thread. We will confirm deletion within seven days.
  • Opt out of personalised adsvia Google’s own controls (the AdSense integration is the only third-party service this site uses).
  • Uninstall the extensionat any time from the browser’s extension settings. All locally cached state is removed by the browser as part of uninstall.

Children

Sourcemap Explorer is a developer tool not directed at children. We do not knowingly collect data from anyone under the age of 13 (or the equivalent age of digital consent in your jurisdiction).

Changes

If this policy changes materially, the “Last updated” date at the top of the page will move and the changelog entry on the about page will mention it. Minor wording or formatting changes may happen silently.

Contact

For privacy questions specifically, write to mapree@mapree.dev with “Privacy” in the subject line, or use the contact form on the homepage.