What the Fetch (WTF) is a browser debugging extension published by josharsh. Contact: harsh.joshi.pth@gmail.com.
Effective October 16, 2026 · Version 1When you choose a tab and agree to record, What the Fetch captures that tab’s request and response URLs, headers and available bodies, console messages, page activity, and performance evidence. These can include personal information, private communications, authentication cookies and tokens, and other sensitive website content. The page chooser reads open tab titles and URLs so you can select the page to debug. It does not send your list of tabs to AI.
During an investigation, browser tools can inspect the selected page’s DOM, accessibility information, cookies and storage, or take screenshots. Tools can also run JavaScript through Chrome’s Debugger API, replay requests, navigate, and temporarily mock responses. The default setting asks for approval before actions that can change page or server state. You control the autonomy setting.
Recordings, conversations and settings are stored locally in this Chrome profile. If you select a recording folder or download an export, files are also saved to that location. Recording by itself does not upload evidence to the publisher or an AI provider. Local records remain until you delete them or remove the extension. Disk files remain until you delete them separately. This release does not add application-level encryption to local recordings or exports; protect your Chrome profile and recording folder using your device’s access controls and disk encryption.
Before the first AI request, the extension names the destination and asks for consent. Your question, relevant conversation history and evidence retrieved by the agent are sent to the selected destination. Evidence can include request and response content, URLs, console output and page information. Recognized credentials are masked by default. Masking is best effort and does not remove every kind of personal or sensitive information.
Your own provider: requests go directly to the API endpoint you configure, using your own key if required. The publisher’s gateway is not involved. Your key is stored in local extension storage, is not synced by the extension and is not included in recording exports. Enabling exact credential sharing can send captured tokens and cookies. Screenshots are sent only when you enable both image support and exact-data access. Your chosen provider’s terms and retention practices apply.
Included AI: requests pass through a What the Fetch gateway hosted on Cloudflare Workers to the provider named in the consent prompt (initially Groq). The publisher’s provider key stays on the server. Included AI masks recognized credentials and does not accept screenshots. Changing the hosted provider, model or endpoint requires renewed consent before further requests. Cloudflare and the selected provider process requests to deliver this feature. Groq’s practices are described in Your Data in GroqCloud; its abuse-monitoring exceptions and your own provider’s policies may differ from local retention.
The gateway processes your IP address and issues a signed installation token valid for up to 30 days. The token is stored locally. To enforce allowances and limit abuse, the gateway stores installation identifiers, daily keyed hashes of IP addresses and usage counters. Active quota records are deleted after 48 hours; Cloudflare platform recovery backups may retain prior storage for up to 30 days. The gateway application does not persist or log prompts, evidence, model responses, raw IP addresses or API keys. Platform infrastructure and the AI provider may process operational or abuse-prevention data under their own policies. Allowances are per installation, subject to shared capacity, and are not a promise of unlimited or uninterrupted service.
Use Record and Stop to control capture. Delete browser copies in Recordings. Delete saved files and exports separately. In Settings you can switch providers, clear your own API key, change credential sharing, or reset data-sharing consent. Removing the extension removes its local Chrome data but not exported files. Contact the address above for privacy questions; do not email sensitive captures or API keys unless a specific secure support arrangement has been agreed.
What the Fetch uses the data described here only to provide debugging, evidence storage, exports, AI investigation and abuse prevention. The publisher does not sell user data, use it for advertising, or use captured data to train general-purpose models. Human access is limited to user-authorized support, security or abuse investigation, legal obligations, or other situations permitted by the Chrome Web Store User Data Policy. What the Fetch’s use and transfer of user data follows that policy, including its Limited Use requirements.
There is no advertising or third-party analytics SDK in this extension. Use it only on pages and data you are authorized to inspect and share.