Last updated October 26, 2026.
Endpoint Picker is a Chrome extension. You click text on a page, and it shows the network response that contained that text. This page says what happens to that data.
What it processes
On pages where it runs, the extension reads the bodies of fetch, XHR, server-sent event, and text WebSocket messages so it can search them when you click. A match can include the URL, method, status, JSON path, a short snippet of the value, a request id header, and the script that started the call.
Those responses may contain whatever the site itself sent, including names, account details, or tokens. The extension does not ask for that. It sees it only because it was already on the page.
Where it lives
Matches stay in the memory of that tab. They are not uploaded, sold, or sent to the developer. Closing the tab, navigating away, or choosing Clear buffer drops them. Nothing is written to a server, an account, or an analytics tool.
What it does not do
- It does not send page contents off your computer.
- It does not read passwords you type. Password fields are skipped.
- It does not inject ads, and it does not run remote code.
- It does not keep response bodies after the tab is gone.
Permissions
The extension asks for access to sites you visit because it has to wrap fetch before the page loads, and you can inspect any site. That access is used for the inspect feature and for nothing else.
Contact
Questions and privacy requests go through GitHub issues.