Why Habeas?
Habeas exists for a simple reason: people should be able to keep and move their own data without surrendering more control in the process.
Receipts, invoices, statements, investment reports, and similar records are often visible on the websites that created them. But visibility is not the same as control. Many services offer no useful export, keep only partial history, or force people to download documents one by one.
What problem does Habeas solve?
Habeas helps you recover access to your own records when a service already lets you see them, but makes them hard to keep. It gives you a way to collect those documents from inside your normal browser session and save them where you choose.
Why isn't data portability already enough?
In theory, people are supposed to have access to their own information. In everyday life, that promise often stops at a website dashboard. The service may not provide an API, may not support bulk export, or may make automation fail behind anti-bot systems.
Just as importantly, many existing workarounds ask users to trust yet another intermediary with their credentials and their history. That solves one barrier by creating another.
Why can a site still show you a CAPTCHA?
Because Habeas works inside your own already-open session, most of the time you never hit anti-bot friction. But Habeas makes no promise of immunity: it does not try to defeat those systems, and behind aggressive defenses a collection can simply fail. If a site does show a challenge, you solve it yourself — exactly as you would while browsing by hand. That is a deliberate limit, not a bug.
Why should users have direct control?
Your records are not valuable only on the website that generated them. You may need them for budgeting, accounting, taxes, switching apps, or simply keeping your own archive. Direct control matters because access should not depend on whether a platform decides to keep a convenient export button forever.
Habeas is built around the idea that people should be able to exercise their rights with tools they can inspect, run themselves, and point at destinations they trust.
What principles guide Habeas?
Data sovereignty
Your documents should remain accessible to you, even when a service offers a poor export experience.
User control
You decide when to collect data and where it goes. Nothing should leave your browser unless you choose it.
Privacy by design
Using a data portability tool should not require creating a new database of passwords, sessions, or personal records somewhere else.
Transparency and trust minimization
The safer model is the one that asks you to trust fewer third parties, fewer servers, and fewer hidden processes.
Why does the architecture follow these principles?
Habeas runs where the website already knows it is talking to you: inside your own authenticated browser session. That means you log in yourself, handle MFA yourself, and keep your credentials to yourself.
This architecture is not a technical gimmick. It is a consequence of the project's values. If the goal is to give users more control, the tool should avoid unnecessary intermediaries, avoid storing your logins, and keep the flow understandable.
Why should you trust the extension with your bank session?
You should not have to, and that is the point. Habeas asks for a great deal: it runs inside the browser session where you are already signed in to your bank. No promise made on this page is a good enough reason to allow that. The only reason that holds is that the code can be read.
All of it is published under the AGPL-3.0, sources are declarative data rather than code, and the extension can load no remote script — Manifest V3 forbids it — so what you audit is what runs. You do not have to read it yourself. It is enough that anyone can, and that any claim made here could be contradicted tomorrow by somebody who looked.
That openness is not a licensing preference that might change later; it is the product. An extension of this kind that could not be inspected would have nothing left to offer, so closing it would be less a betrayal than a demolition. The licence settles the rest: AGPL-3.0 grants its rights for the full term of the copyright and makes them irrevocable, so every release published so far stays free permanently. Were this project ever abandoned, or were it to take a turn you disliked, anyone could take the last release and carry it on.
Why a browser extension instead of official open-banking (PSD2) channels?
For payment-account data, regulated open-banking APIs — reached through licensed aggregators — are the canonical path, and where they serve you well they are often the better choice. Habeas does not try to replace them there.
But PSD2 covers only payment accounts. It does not reach store and credit cards, investment or pension statements, invoices, or receipts — the long tail of records that services still lock behind a dashboard. Aggregators also ask you to delegate access to a third-party server; Habeas runs in your own session, stores no credentials, and lets you resolve MFA yourself. It initiates no payments and aggregates nothing on a server, so it is not a PSD2-regulated actor — it is a personal data-portability tool (GDPR Article 20) that you run yourself.
Free and open source (AGPL-3.0). Chrome will warn you that the extension is not trusted: that happens to any developer account recently registered on the Chrome Web Store, it fades after a few months, and it says nothing about the code — which you can read in full.