Skip to content

XML Sitemap Inspector — Privacy Policy

Last updated: 5 October 2026

XML Sitemap Inspector (including its Beta edition) is a Chrome extension published by LW AGENCY LIMITED ("Lotus Web Agency", "we"). It finds, displays and validates the XML sitemaps of the website you are viewing. It does not collect, sell or share any personal or usage data, and nothing it reads or stores is ever sent to us.

This policy covers the extension only. Our website has its own privacy policy and terms of use.

What the extension accesses

Nothing happens until you click the extension's toolbar icon. After that, a scan you started can go on when you open it in the viewer (see the next section).

  • The address of the current tab. It is used to work out which site to inspect. Only when that address looks like a sitemap file (for example its path ends in .xml or contains "sitemap"), the extension also requests it each time it scans the site, to check whether the tab is showing a sitemap. Other addresses are never requested.
  • The address, canonical link and sitemap links of the current page (<link rel="canonical"> and <link rel="sitemap">), read once when you open the popup on that site. At most 20 sitemap links are used. They are added to the places the extension looks for sitemaps. The page's address and canonical link are only compared with the sitemaps' contents, to tell you whether the page is listed in its own sitemap. The canonical link is not saved, and the page's address is saved only in the one case described under "What is stored, and where". Nothing else on the page is read.
  • The site's robots.txt and sitemap files, which the extension downloads directly from that site, as described in the next section.

Requests to websites

All requests are plain downloads sent from your browser. They carry no cookies or login credentials and they follow HTTP redirects the way a browser does. They are sent only after you click the icon or a button in the popup. One exception: opening a scan in the viewer can continue a scan that stopped early at its time or size limit, and that sends the same kinds of requests to the same sites. They go to:

  • the site's robots.txt, to read its Sitemap: lines and its crawl rules;
  • the sitemap files that robots.txt and the page's sitemap links point to, and the sitemaps listed inside sitemap indexes;
  • for each sitemap found, a small request to learn the file's size before it is downloaded: a partial request for its first 2 KB and, for a .gz file, its last 4 bytes. A site may therefore log two or three requests per sitemap, at most four;
  • 24 usual sitemap locations on the same site (for example /sitemap.xml, /sitemap_index.xml and /wp-sitemap.xml). These are guesses: most sites have few of them, so the site will log mostly "not found" answers. The extension reads only the beginning of each answer to tell whether it is a sitemap, and drops it if it is not;
  • the page's own sitemap links and the tab's address, only in the cases described above. These are checked the same way and dropped if they are not sitemaps;
  • a sitemap address you type or paste into the popup and add yourself, which can be on any site;
  • wherever those requests are redirected, which can be another site.

If a sitemap is on a different domain from the site you are inspecting (because robots.txt, a sitemap index, a page link or an address you typed points there), the extension does not request it until you click "Grant access" and Chrome asks for your permission for that domain. Once granted, later scans can read sitemaps there without asking again until you revoke it. A redirect can lead to a domain you have not granted: the request is still sent, but Chrome lets the extension read the answer only if you have granted that domain or the other site's server explicitly allows it.

Like any request to a website, these requests reveal your IP address to the site you are inspecting and to any site a redirect leads to, and those sites may log them.

Buttons that open a sitemap, robots.txt or a URL from a sitemap in a new tab are ordinary browser navigation that you start with a click. They are not requests made by the extension.

What is stored, and where

Scan results are saved in the extension's own local storage (IndexedDB) on your computer so the viewer can display them. A scan holds:

  • the sitemaps found: their addresses, HTTP status, Last-Modified date, content type and whether they were redirected, plus their raw text;
  • the URLs they list, with their dates, priorities, language alternates and image counts, and the validation findings;
  • the site's robots.txt address and status, the Sitemap: lines in it and its parsed crawl rules (the allowed and disallowed paths of each crawler);
  • the address of the tab the scan was started from, but only when that address looked like a sitemap file. It is kept with any query string it has (the part after "?"), without a username, password or "#" fragment.

Only the 10 most recent scans, of all sites together, are kept. After every scan, older ones are deleted automatically together with their sitemap text. Uninstalling the extension, or clearing its site data in Chrome, deletes everything it stored.

Scans of very large sites can take several gigabytes. A scan that stores more than 500 MB is therefore kept more strictly: only the newest one stays, plus any that a viewer tab has open or a running scan is still using. The others are deleted automatically, and so are those older than 24 hours and, when Chrome starts a new browser session, those not open in a viewer tab. When you open the viewer on a large scan, the extension also checks how much free disk space the browser has and limits the scan's size to a share of it.

The extension also uses Chrome's session storage (storage.session). Chrome keeps it in memory and clears it when the browser closes. It holds a marker that a browser session has begun and, while a viewer tab shows one of those very large scans, a note with that scan's internal ID that expires after 90 seconds unless the tab renews it. It holds no browsing data, and nothing in it is sent anywhere.

While a scan runs, the extension may open a hidden extension page (an "offscreen document") that only compresses scan data before it is saved. It works on data the extension already holds, in your browser, and makes no requests. It closes when the scan ends, and it closes itself if the extension stops unexpectedly. It adds no new data access, and nothing leaves your browser.

The interface language you pick in the popup or the viewer is saved in the extension's own local storage (localStorage) on your computer, so both open in that language next time. It is deleted with the extension.

Incognito windows. If you allow the extension in Incognito, it runs there as a separate copy ("split" mode). Data from Incognito windows is held only in that copy's temporary storage and is deleted when the Incognito windows close. It is never mixed with the data of your regular profile.

What is not done

  • Nothing the extension reads or stores is sent to us or to any third party. Its only network requests are the ones described under "Requests to websites", and the sites that receive them are the website you are inspecting, other domains its sitemaps point to once you have granted access, and wherever those files redirect.
  • No analytics, telemetry, tracking, advertising or crash reporting.
  • No accounts or sign-in.
  • No tracking of your browsing. The extension does nothing on pages where you haven't clicked its icon. The only record of a site it keeps is a scan you started yourself, stored locally as described above.

Permissions

  • activeTab: after you click the icon, Chrome gives the extension temporary access to the current tab and its site. The extension uses it to read the tab's address and to download that site's robots.txt and sitemap files. The access is limited to that tab and ends when you close it or leave the site.
  • scripting: used together with activeTab for one read of the current page's address, canonical link and sitemap links, which happens once when the popup opens. No script stays on the page, and nothing else on the page is read.
  • storage: gives the extension access to Chrome's session storage, described under "What is stored, and where". It is used to tell which scans an open viewer tab is showing and when a new browser session has begun, so that very large scans can be cleaned up safely. It is cleared when the browser closes.
  • offscreen: lets the extension open the hidden page described under "What is stored, and where" while a scan runs, so compressing scan data does not slow the extension down. The page only compresses data for the extension, holds nothing after the scan ends, and is closed then.
  • Optional access to websites: asked for one site at a time, and only when a sitemap lives on a domain the extension can't reach otherwise. You can revoke it in Chrome's extension settings at any time.

The extension requires Chrome 111 or later.

Changes

If this policy changes, the updated version will be published at this address with a new date.

Contact

LW AGENCY LIMITED, Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong
support@lotuswebagency.com · https://lotuswebagency.com/contacts/