Permissions and privacy

On-demand host access

The extension declares HTTP and HTTPS access as optional. It asks only when you enable a redirect or header rule that requires a specific origin.

Rules, backups, and test inputs remain in browser storage. RequestOrbit has no analytics or remote rule service.

Keep scope bounded

Prefer a concrete scheme and host. For subresource redirects or header edits, add initiator domains so the extension can limit which pages may trigger the rule.