Overview
helixatom Remote JS Debugger is a developer tool for live remote debugging in the browser. It does not require an account. Debug traffic prefers a direct peer-to-peer WebRTC path between your dashboard and the page you attach. We do not monitor or inspect that traffic.
Information we process
Session keys and connection metadata
To pair a dashboard with one or more client pages, you choose or generate a session key. That key (and related signaling messages needed to discover peers and negotiate WebRTC) is sent to the configured signaling WebSocket service so clients in the same session can find each other.
Debug payloads (console, API events, remote code)
Console logs, API-style request events, memory checks, and remote code results are streamed for your live session and displayed in your browsers. When a WebRTC peer connection is established, those payloads travel directly between the dashboard and client. We do not monitor, inspect, or log that peer-to-peer content.
Optionally, the client SDK may keep a capped buffer of recent console/API events in the target page’s local browser memory (enabled by default; not saved to helixatom’s cloud) so a late-joining dashboard can request earlier events. If that buffer contributes to performance issues on the debugging client, you can disable it. The dashboard may also keep on-screen logs for a disconnected client until you reload the dashboard tab. Neither is a cloud log archive.
If WebRTC is unavailable or ICE fails (for example behind a firewall, VPN, or strict NAT), the client may fall back to a WebSocket relay through our signaling server so the session can continue. In that mode, payloads transit our server only to be forwarded between your endpoints. We do not monitor or log the contents of those relayed debug messages.
Local saved functions
Titles and code for saved functions are stored in your browser (IndexedDB when available, otherwise localStorage) on this site’s origin. Exporting a .hatomf file creates a local file you control. We do not operate a cloud account store for these snippets.
URL parameters
The dashboard may keep session UI state in the address bar (for example session key or selected tab). That stays in your browser history and any URL you share. Avoid sharing session URLs for sensitive debugging sessions.
Analytics and crash reporting
When enabled for a build, the dashboard may use Google Analytics 4 (via Google Tag / gtag.js) to understand aggregate product usage — for example page views and high-level actions such as connecting a session, running remote code, opening the API or JSON viewers, or exporting logs. Event parameters are limited to non-sensitive metadata (for example counts or path names). We do not send session keys, remote code bodies, console/API payload contents, or saved-function source to analytics.
The same measurement configuration is used for web crash and error reporting: unexpected JavaScript errors and unhandled promise rejections (including React render failures) may be recorded as exception events with a short error message, truncated stack preview, page path, and similar diagnostic fields. This is the web counterpart to mobile crash tooling (such as Firebase Crashlytics). Debug session payloads are still not included.
Analytics and crash reporting run only when a measurement ID is configured for that deployment. If it is not configured, those features are inactive and no gtag requests are made for them.
Google may process standard device and connection signals (for example approximate location derived from IP, browser type, and timestamps) under Google’s terms when Analytics is enabled. We request IP anonymization for Analytics hits where supported.
Advertising
The site may display ads served by Google AdSense. AdSense and its partners may use cookies or similar technologies to show relevant ads and measure ad performance. Ad delivery and related data processing are handled by Google under Google’s advertising policies and terms. Debug session payloads (session keys, remote code, console/API contents, saved functions) are not used for advertising.
What we do not collect by default
- No user accounts, passwords, or profile photos
- No advertising or analytics of session keys, remote code, console/API message bodies, or saved-function source
- No requirement to provide an email address to use the debugger
- No monitoring or content logging of debug payloads on P2P or relay
How we use information
- To establish and maintain debugging sessions you initiate
- To deliver the dashboard, docs, FAQ, and static assets
- To operate signaling (and, when needed, an unmonitored relay) so peers can communicate
- When Analytics is enabled: to measure product usage and improve reliability (including diagnosing crashes)
- To support site funding through third-party advertising (AdSense)
Hosting and infrastructure
The static website may be hosted on infrastructure such as Firebase Hosting or a similar CDN. Signaling (and optional relay) runs on the WebSocket endpoint configured for the build. Hosting providers may process standard operational connection metadata (for example IP addresses or connection timestamps) according to their own terms. That is separate from debug payload contents, which we do not monitor or log.
Data retention
Live debug streams are for the active session in your browsers; they are not offered as a permanent hosted archive, and we do not retain debug payload contents for review. Local saved functions remain until you delete them or clear site data.
Your choices
- Disconnect or close the tab to end a live session
- Clear this site’s browser storage to remove saved functions
- Avoid injecting the client into pages you are not allowed to inspect
- Prefer networks that allow WebRTC when you want direct peer traffic
- Use browser controls or extensions to limit Analytics or AdSense cookies / storage for the deployment you use
- Visit Google Ads Settings to manage personalized ads from Google
Children’s privacy
The service is intended for developers and technical users. It is not directed at children under 13, and we do not knowingly collect personal information from children.
Changes
We may update this Privacy Policy as the product evolves. The “Last updated” date at the top will change when we publish revisions. Continued use after an update means you accept the revised policy.
Contact
Questions about this policy: helixatom@googlegroups.com. See also our Terms of Use and FAQ.