Home / Privacy Policy

Privacy Policy

Two separate things, answered separately: what the extension does on your own machine, and what this website measures.

Last updated 10 August 2026

Overview

This page covers two separate things: the Tag Master extension, and this website. They behave differently and each gets its own answer below. If the cookie banner sent you here, the website section is the one you want.

Tag Master is a Chrome extension for debugging and auditing website tracking tags — Google Analytics, Google Tag Manager and 50 other analytics and advertising platforms.

Tag Master has no account, no telemetry and no server of ours. It reads the tracking requests of the sites you choose to inspect and shows them to you. What it reads stays in your browser; none of it is sent to us or sold to anyone.

What Tag Master reads

To do its job, Tag Master reads, on the sites you choose to inspect:

the tracking requests those sites send, and their parameters
the page's dataLayer and the tags present on the page
the tracking cookies already set on the site
JavaScript errors and page-load information

This is web activity data, and we say so plainly rather than claiming otherwise: showing you this data is the product. It is used for nothing else. It is not profiled, not aggregated, not sold, and not used for advertising.

Where it goes

Nowhere. It is written to your browser's own storage (chrome.storage and IndexedDB) and read back by the extension's side panel. It never reaches us — there is no endpoint to reach.

The one outbound request

When you press Read container next to a detected GTM container, Tag Master fetches gtm.js from Google so it can list the container's tags and triggers and compare them with what actually fired. The only thing in that request is the container ID, which is public. No data of yours is attached, and the file is parsed as text — never executed. Nothing else in the extension makes a network request.

Stored locally

Preferences: theme, interface scale, filter and panel settings
Saved GTM snippets: container snippets you pasted yourself, kept under their container ID
Feature settings: vendors you chose to block, GA4 DebugView mode, and the server-side GTM preview token and endpoint you entered
Debug logs: dataLayer events and network requests captured during your sessions

All of it can be cleared from the extension's Settings panel, or by uninstalling the extension. It is not readable by websites or by other extensions.

Permissions

This list matches manifest.json exactly.

storage

Your preferences and captured debugging sessions, kept on your device.

scripting

Re-injects the detection scripts into tabs that are already open, and injects the GTM snippet you paste.

sidePanel

The extension's interface is a side panel.

cookies

Shows the tracking cookies on the site you are inspecting (_ga, _gcl_aw, FPID, _fbp, _uetsid and the rest), and deletes or creates test cookies when you ask it to.

webRequest

Observes tracking requests so their parameters can be decoded and displayed. Requests are read, never modified.

webNavigation

Attributes captured events to the page navigation they belong to.

declarativeNetRequest

Powers three optional features, all off by default and all driven by your explicit choices: the hit blocker, GA4 DebugView mode, and the server-side GTM preview header. Rules are removed as soon as you switch the feature off. No request content is read or stored through this API.

<all_urls>

Tag debugging has to work on whichever site you are inspecting — a client site, a staging build, localhost — and tracking endpoints differ per site, including first-party server-side GTM endpoints on your own domain.

This website

Everything above is about the extension, which runs on your machine and talks to nobody. This section is about tagmaster.dev itself, which does measure its own visitors, and says exactly how.

Nothing identifies you until you choose

Consent Mode defaults are set to denied before any Google tag loads — not after, which would be too late to mean anything — and the banner asks before anything runs. Rejecting is one click, in the same place and at the same size as accepting.

What runs once you accept

Google Analytics 4 and Google Tag Manager — which pages and guides get read, and how people arrive. Aggregated, and never sold.
Microsoft Clarity — how pages are actually used. Clarity does not read Consent Mode, as no non-Google tool does, so it is not in the page at all until analytics consent is granted. It is added afterwards, or never.

If you reject, no cookie is set and nothing can follow you between visits. What is left is a cookieless ping: with analytics storage denied, Google Analytics still sends one request per page, carrying the address of the page and no identifier. It sets nothing, it cannot tell this visit from any other, and Google uses those requests for aggregate modelling. We would rather write that down than claim nothing leaves the browser, because you can watch it leave with any debugger — including ours. Clarity, meanwhile, is never added to the page at all.

The cookie this site sets

tm_consent records your answer — the four Consent Mode signals, nothing else — for a year, so the banner does not ask again on every page. It contains no identifier and is readable only by this site. Accepting analytics additionally lets Google Analytics set its own cookies (_ga, and one per property) to tell a returning visit from a new one.

Changing your mind

Use Cookie settings at the bottom of any page. It reopens the same banner, and the new answer replaces the old one immediately. Clearing this site's cookies does the same thing: you will simply be asked again.

Hosting

The site is static and served by Cloudflare Pages. Cloudflare handles request data such as IP addresses in order to deliver the pages and protect the site, as any host does. There is no server of ours behind it and no database.

Chrome Web Store Limited Use

Tag Master's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The extension reads the tracking requests, page data and cookies of the sites you choose to inspect, and uses them for one purpose: displaying those tags to you inside the extension. This is the extension's single, user-facing purpose, described on its Chrome Web Store page and visible in its interface. The data is not transferred to us or to any third party, is not used for advertising or personalisation, is not sold, and is not used to assess creditworthiness.

Children's privacy

Tag Master is a professional tool for marketers, developers and analytics practitioners. We do not knowingly collect data from anyone, including children under 13.

Changes

We may update this policy as the extension changes. Updates appear at this URL with a new "Last updated" date.

Your control

Clear everything from the Settings panel, or by uninstalling
Turn any optional feature off; they ship off
Inspect exactly what is stored with DevTools → Application → Storage
Export your debugging logs as JSON or CSV before clearing

Verifying this yourself

You do not have to take this page's word for it. The extension is unpacked JavaScript: open chrome://extensions, turn on Developer mode, and read the files Chrome installed. The network panel of your own DevTools will show you every request the extension makes, which is one — gtm.js from Google, when you press "Read container".

Contact

Questions about privacy? Email hsynkavalci@gmail.com.