Privacy Policy

Last updated: 12 August 2026

RefKit runs on your machine. It has no accounts, no analytics, no telemetry, and no server that receives your data. The short version: nothing leaves your computer unless you explicitly send it somewhere you control.

Who is responsible

RefKit is an independent developer tool. Questions about this policy can be sent through the support page.

What the extension reads, and when

Nothing is read until you click. RefKit declares no content scripts and no host permissions, so it cannot run on a page in the background or inspect a tab you have not pointed it at. When you press Capture this page, it uses the temporary access Chrome grants for that one tab and collects:

• computed CSS values — colours, fonts, sizes, spacing, radii, shadows, transitions;
• the size and position of elements, used to weight which colours dominate the page;
• the visible text of an element, capped at 400 characters, used to tell a heading from body copy and to measure contrast;
• style rules for hover, focus, active and disabled states, when the page’s stylesheets are readable;
• author-declared CSS custom properties (design tokens), breakpoint widths from media queries, the page URL, page title, viewport size and colour scheme.

What it never reads

• Cookies, localStorage, sessionStorage or any session data.
• Your browsing history, other tabs, or any page you did not capture.
• Raw page HTML. Only the bounded set of properties listed above is collected.
• Passwords or the contents of form fields.

Because captured text is used for typography and contrast, a capture can contain words that were visible on the page — including on a page you are signed in to. Review a capture before you send it anywhere. The side panel shows you what was derived before anything is stored.

What is stored, and where

Data we transmit

None to us. RefKit operates no backend. There is no endpoint that receives captures, usage statistics, error reports or identifiers, because no such service exists.

The extension can send a capture to one place, and only if you set it up: a RefKit server running on your own computer at 127.0.0.1. That connection requires an optional permission you grant during pairing and can revoke at any time in Chrome’s extension settings, plus a token generated for your project. The server refuses requests that come from web-page origins.

Third parties

There are none. No analytics provider, no error tracker, no advertising network, no AI service. Nothing about your captures is sold, shared or used to train anything.

Retention and deletion

Because storage is local, you control deletion entirely. Removing the extension clears its browser storage; deleting the .refkit/ directory in a project removes its captures and profile. There is nothing held elsewhere for us to delete on request.

Children

RefKit is a developer tool and is not directed at children under 13, and it does not knowingly collect information from them.

Changes

If this policy changes in a way that affects what is collected or where it goes, the change will be published here with a new date before a release that depends on it. The permissions the extension requests are enforced by an automated contract test, so a quiet expansion of access cannot ship unnoticed.

Chrome Web Store disclosures

RefKit’s single purpose is to capture the visual design of a page you choose and make it available to your coding tools. Handling of user data complies with the Chrome Web Store Developer Program Policies, including the Limited Use requirements: data is used only for that single purpose, is never sold or transferred for advertising or creditworthiness, and is not transferred to any third party.