Privacy Policy - EchoScope Laravel Reverb & WebSocket Inspector

🛡️ Executive Summary: 100% Client-Side Developer Sandbox

EchoScope is built strictly as a local developer inspection tool. When you connect to your local or remote WebSocket server (e.g. Laravel Reverb, Pusher, Soketi), all connection handshakes, authentication tokens, and broadcast payloads stay 100% inside your browser memory.

We do not operate backend logging servers, we do not inspect your broadcast payloads, and we do not collect telemetry on your internal application events.

1. Information We Do NOT Collect

Because EchoScope operates exclusively on the client side:

Zero Event Payloads: Broadcast messages, order IDs, user tokens, or real-time payloads flowing through WebSockets are rendered only on your local screen and never uploaded.
Zero Credentials & Secrets: Your Laravel APP_KEY, Pusher app credentials, Bearer tokens, and auth cookies are stored only in your local browser sandbox via chrome.storage.local.
Zero Remote Telemetry: We do not include third-party tracking pixels, Google Analytics, or external behavioral trackers.
Zero Advertising SDKs: EchoScope is 100% ad-free, open-source software under the MIT License.

2. Browser Permissions & Technical Justification

EchoScope requests minimal permissions required to inspect WebSocket connections and store connection profiles:

Permission	Technical Purpose
`storage`	Allows saving your local server connection profiles (host URL, app key, and channel subscriptions) locally in `chrome.storage.local` so you don't have to re-type them on reload.
`activeTab`	Used when popping out the inspector into a dedicated tab to maintain session state alongside your active developer workflow.
`WebSocket Network`	Direct RFC6455 WebSocket client connection initiated from your browser directly to your configured Reverb or Pusher host (e.g. `ws://127.0.0.1:8080`).

3. Private Channel Authentication Security

When you subscribe to a private channel (e.g. private-orders.1), EchoScope makes a direct POST request to your application's /broadcasting/auth endpoint.

This request uses your browser's existing session cookies or custom headers that you manually configure. It communicates directly and solely with your application's server. No intermediary proxy or third-party server is ever involved.

4. Open Source Verification & Auditing

EchoScope is transparent and open source under the MIT License. The entire source code is publicly inspectable and verifiable on GitHub at:

https://github.com/sajusun/echo-scope

5. Store Developer Policy Compliance

EchoScope adheres strictly to the Microsoft Edge Add-ons Developer Agreement and Google Chrome Web Store Developer Program Policies. All code is bundled locally without remote script evaluation.

6. Developer Support & Questions

If you have questions regarding this Privacy Policy or wish to report an issue, please open an issue on the official GitHub Issue Tracker or contact the developer via our portfolio hub.