Last updated: November 5, 2026
ReqSwapr is a Chrome extension that replaces request URLs using wildcard rules you write. It has no servers, accounts, analytics or ads, and the developer doesn’t receive any of your data.
All of this stays in your browser.
| Data | Why | Where it’s kept | How long |
|---|---|---|---|
| Your rules (target and destination URLs) and the “Enable for all tabs” and “Remove page CSP” settings | To apply your rules | chrome.storage.local |
Until you delete them or uninstall the extension |
| Your per-tab on/off choices | To know which tabs to replace requests in | Chrome’s session rules | Until the tab closes or the browser restarts |
| Your light or dark theme choice | To display the panel | The side panel’s local storage | Until you uninstall the extension |
| Web browsing activity: the method, URL, status, resource type and timing of requests | To show the Traffic list | Memory in the side panel, up to 500 requests per tab | Until you click Clear, close the tab or close the panel |
While the side panel is open, it records requests from all tabs in the browser, not just the active one, so that the list is ready when you switch tabs. It only displays the active tab’s requests. Nothing is recorded while the panel is closed.
ReqSwapr doesn’t read or log request headers, response bodies or page content. When a page calls fetch with a Request object that matches a rule, its body is copied into the rewritten request so it can be sent to your destination. It isn’t stored or inspected.
ReqSwapr doesn’t send data to the developer or any third party on its own.
Authorization header and a request body. Only use destinations you trust.fetch and XMLHttpRequest can be rewritten. Scripts on those pages can read your rule URLs and can see the replaced URLs of their own requests. Don’t put secrets in rules.The optional “Remove page CSP” setting is off by default. When on, it removes the Content-Security-Policy response header from pages and frames in tabs where ReqSwapr is on, which reduces those pages’ protection. The side panel shows a warning while it applies. ReqSwapr doesn’t collect anything through this setting.
ReqSwapr uses this data only to provide its rule and traffic features. The data isn’t sold, used for advertising, used to determine creditworthiness or transferred to anyone. No person can access it, because it never reaches the developer.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.