Finxture Privacy Policy
Effective date: 2026-07-19 Owner: dmgritsan ltd, a company registered and operating in Cyprus (EU) Contact: [email protected]
Finxture is a free Chrome extension for developers: a payment sandbox that sends signed, synthetic test webhooks to a localhost or 127.0.0.1 endpoint you configure, so you can build and debug webhook handling without an inbound tunnel like ngrok. This policy also covers finxture.dev, Finxture’s website.
This page describes what Finxture does with your data. It is deliberately short, because the honest answer is short.
The short version
Finxture never sees your payment data. Your endpoint configuration, your generated test signing secret, and your scenario run history (including request and response previews) are written to Chrome’s local extension storage on your own machine and never leave it.
The one exception is anonymous product telemetry — described in full below — which is limited to coarse counters and never includes your payloads, secrets, or endpoints:
- No webhook bodies, secrets, payloads, or response content are ever sent anywhere except the localhost/127.0.0.1 address you explicitly configured.
- Telemetry is limited to anonymous usage counters (for example, “extension installed” or “scenario run completed”). It never contains payloads, secrets, endpoint URLs, response content, or anything that identifies you personally. See “Usage telemetry” below, including how to turn it off.
- No accounts, no sign-in, no payment processing by Finxture itself.
- No third parties receive your payload or secret data. Anonymous telemetry counters go to Finxture’s own infrastructure, not to outside vendors (see “Third parties”).
Everything below is detail in support of that claim, not a hedge on it.
What Finxture does
Finxture runs entirely inside the browser side panel. You configure a webhook
target on localhost or 127.0.0.1 (with an explicit port), choose a scenario
(for example, “Payment succeeds”), and Finxture delivers a sequence of
deterministic, Stripe-compatible test webhook events — signed with a locally
generated, test-only signing secret — directly to that address from your own
browser. It keeps a durable local timeline of each run so you can inspect,
replay, resume, or export it.
Finxture does not process real payments, does not talk to Stripe or any other payment provider’s servers, and does not generate or handle real cardholder data. All events are synthetic.
What we do NOT collect
To be explicit, because this is the part that matters most — regardless of telemetry, described in the next section, none of the following is ever collected:
- Webhook payloads, signing secrets, endpoint URLs or paths, or response content. They are never transmitted to us or to anyone else, under any circumstance, including inside telemetry.
- Anything typed into your local application at the other end of your webhook target — Finxture has no visibility into it.
- We do not use Chrome sync for any Finxture data — nothing is uploaded to your Google account or synced across devices.
- We do not use cookies, fingerprinting, or any cross-site tracking technique in the extension. Finxture has no content scripts and does not read the content of any web page you visit.
- We do not store your IP address as part of telemetry (see below).
Usage telemetry
Finxture collects anonymous usage telemetry by default. This is a deliberate product decision, and we’d rather state it plainly than bury it:
- What’s collected: coarse, aggregate counters only — for example,
“extension installed,” “endpoint configured,” or “scenario run
started/completed,” recorded together with the scenario’s identifier (for
example
payment-succeeds). - What’s never collected, even in telemetry, permanently: webhook bodies, signing secrets, payloads, endpoint URLs or paths, response content, or any stable personal identifier. Your IP address is not stored as part of telemetry. This is a permanent commitment, not a today-only description — even as telemetry evolves, it will never expand to include these.
- By using the extension, you agree to this telemetry. It is enabled by default rather than opt-in. An opt-out toggle in Finxture’s settings is planned so you can turn it off; until it ships, you can prevent all network activity, including telemetry, by not granting the extension any runtime host permission and by removing the extension if you’d rather not participate at all.
Scope note: this policy covers the free, extension-only product. A future paid cloud mode — where webhook bodies necessarily transit Finxture-operated infrastructure, unlike the local-only extension described here — is a materially different data flow and will get its own reviewed policy revision published before that mode launches. Nothing here should be read as covering a product that doesn’t exist yet.
What is stored locally, and how to delete it
Finxture stores three things in Chrome’s local, per-extension storage
(chrome.storage.local), which stays on your device and is never synced:
| What | Contents |
|---|---|
| Workspace configuration | Your normalized loopback endpoint URL and selected scenario. |
| Signing secret | A generated, test-only Stripe webhook signing secret. |
| Run history | Ordered synthetic event bodies, delivery attempts, request headers, timing, and a response body preview (capped at 4 KiB) for each run. |
None of this is encrypted beyond whatever protection Chrome’s profile storage already provides, and none of it is accessible to other extensions or web pages. None of it is included in telemetry.
To delete it:
- Use Clear history in Finxture to remove stored runs (this keeps your workspace configuration and signing secret).
- Use the signing-secret controls in Finxture to regenerate or clear the stored secret.
- Remove the Finxture extension from Chrome (
chrome://extensions) to delete all Finxture local storage immediately and completely — Chrome does this automatically as part of removing an extension.
Permissions Finxture requests, and why
Finxture asks for the minimum Chrome permissions needed to work, and requests network access to your own local server only at runtime, only for the one host you choose:
| Permission | Why Finxture needs it |
|---|---|
storage |
To save your workspace configuration, signing secret, and run history locally, as described above. |
sidePanel |
To host the Finxture UI in Chrome’s side panel. |
Optional host access to http://localhost/* or http://127.0.0.1/* |
Requested only after you enter a webhook target and take an explicit action to grant it. Chrome grants access to the one loopback host you chose (across its ports); Finxture then sends requests only to the exact URL, port, and path you configured — never to any other address. Changing hosts revokes the old grant; clearing your endpoint revokes access entirely. |
Finxture does not request host_permissions for arbitrary websites, does not
request downloads, nativeMessaging, unlimitedStorage, or any Chrome
permission beyond the two above. It has no content scripts and no
externally-reachable surface. Separately from the loopback permission above,
Finxture sends the anonymous telemetry counters described above to Finxture’s
own servers; this is ordinary extension network activity, not tied to your local
endpoint or its permission grant.
The connectivity check Finxture offers (a HEAD request to your configured URL)
reads only the HTTP status code and timing to tell you whether your local server
is reachable; it does not read or store the response body.
Exports
Finxture lets you export a run as JSON, entirely on your own device:
- Export full JSON includes the complete run, including the signing secret. It is intended for your own debugging and is not suitable for sharing publicly.
- Export redacted JSON removes credentials, signature and authorization headers, cookies, API keys, cardholder-like fields, customer contact data, response previews, and target paths, so it is safer to share (for example, in a bug report).
Both exports are triggered only by your explicit action and are saved as a local file download by your browser. Finxture does not upload either export anywhere, and exports are never included in telemetry.
Third parties
Finxture does not share your webhook payloads, signing secrets, endpoint data, or run history with any third party — that data is never collected in the first place, so there is nothing to share.
One limited data flow exists outside your local machine: telemetry, described above, which goes to Finxture-operated infrastructure (i.e., us, the first party), not to an outside analytics vendor. finxture.dev itself introduces no additional third-party data flow — see “Website” below.
The only other third party in the picture is Google, which operates the Chrome Web Store. Like any extension listing, Finxture’s Chrome Web Store page may show Google-provided aggregate install and rating statistics; that data is collected and controlled by Google under Google’s own privacy policy, not by Finxture.
Website
finxture.dev, Finxture’s website, collects nothing: no analytics, no cookies, and no forms. There is no way to submit any data to finxture.dev today.
A scenario-update subscription is planned but has not shipped. Before it launches, this policy will be revised — with a new dated revision, published first — to describe exactly what is collected, how consent is obtained, and how to unsubscribe, following the same “publish before it ships” commitment described in “Future changes” below.
Data protection (GDPR)
Finxture processes no personal data. Everything sensitive the extension creates stays in local browser storage on your device, and telemetry is anonymous and counter-only, as described above. finxture.dev collects nothing, so it introduces no personal data processing either. If that changes — for example, when the scenario-update subscription described in “Website” above launches — this section will be updated first, in the same dated policy revision that introduces the new data flow.
This policy is issued by dmgritsan ltd, a company registered and operating in Cyprus (EU). We don’t add a full choice-of-law or venue clause here — this policy is short because there generally isn’t much to construe.
Future changes
Finxture’s roadmap includes a future, separate paid cloud mode, described in “Usage telemetry” above. That mode does not exist today and is not enabled by anything currently shipping; it will receive its own reviewed policy revision before it launches, because it introduces a materially different data flow (webhook bodies transiting Finxture-operated infrastructure) that this policy does not cover.
If Finxture’s data handling changes in any other way — including telemetry gaining new fields, the planned settings opt-out toggle shipping, or the scenario-update subscription described in “Website” above launching — we will:
- Publish the change in a dated revision of this policy before it ships.
- Describe plainly what is collected, why, and how it can be controlled.
- Never retroactively apply a broader policy to justify data already collected under this one.
Changes to this policy
We will update the effective date below whenever this policy changes and will keep prior versions available on request. Continued use of Finxture after an update means you accept the revised policy; if you disagree with a change, stop using Finxture and remove it (see “How to delete it” above).
Contact
Questions about this policy or Finxture’s data handling: [email protected]
Effective date: 2026-07-19