When source requests are enabled and you click Fetch snippet, Traceglass requests that script from its HTTPS hosting server. Browsing-activity transmission is declared as required at installation; the extension settings checkbox controls whether requests are allowed afterward. The recipient is the script’s hosting server, which may be operated by the website or a third party. It receives the script URL including any query, your IP address and normal HTTPS request metadata. It may log requests under its own policy. Requests omit cookies, HTTP authentication and referrer. Redirects are rejected. Responses are limited to 1 MiB and five seconds and are requested with no-store.

Source text is displayed locally as inert text, never executed, and is not included in JSON reports. Fetched code may differ from the version that ran on the page. Disabling source requests aborts in-progress requests where possible; it cannot recall a request already received by a server. There is no telemetry, advertising, account service or developer-operated collection endpoint.