Habeas is an open-source (AGPL-3.0) browser extension for Chrome and Firefox that extracts your personal data — receipts, invoices, bank transactions, investment positions — from web services that offer no automatable way to do so. The name comes from habeas data, the constitutional right to access your own personal data held by third parties. Habeas does not grant you a new right — it makes an existing one executable. It is a public beta.
The problem
The GDPR (Articles 15 and 20) guarantees your right to access your personal data and receive it in a structured, machine-readable format. But many services comply on paper while making export practically impossible: no API, no email export, and a web interface guarded by anti-bot walls (Cloudflare, Akamai, DataDome). Your right exists; exercising it does not.
How it works
Unlike commercial aggregators (Plaid, Tink, TrueLayer) that custody your credentials and access services from external servers, Habeas runs inside your own browser session:
- No anti-bot fight — it’s your real browser, your IP, already trusted by the service.
- No stored credentials — you log in yourself, you handle MFA/OTP. Habeas never sees your credentials and never logs in on your behalf.
- Local-first — there are no aggregation servers; your data only goes where you decide.
Export destinations
Habeas separates where data comes from (sources) from where it goes (sinks). Available sinks are:
- Downloads — a single ZIP of the original documents plus a
manifest.json. - Local folder — via File System Access; point it at a Drive/Dropbox-synced folder.
- Google Drive — native OAuth upload into a
Habeas/<service>/<year>/tree. - Dropbox — native OAuth upload.
- WebDAV — to your own server (Nextcloud and compatibles).
- S3 and compatibles — MinIO, Cloudflare R2, Backblaze B2.
- HTTP — POST to your own endpoint (e.g. another app of yours).
Declarative sources
Each service is defined as a declarative source in a data file: host, login signal, endpoints, field mapping (JSONPath), dedupe key, and output schema. There is no arbitrary JavaScript — only data and a bounded set of predefined transforms (dates, amounts, regex). This makes sources auditable and community-contributable. A built-in session recorder infers a new source definition from your real browsing, lets you review it and — if you wish — share it with the community.
Source catalogue
The catalogue already gathers 17 production-ready sources and keeps growing:
- Shopping and retail — Carrefour Spain (receipts and fuel), Dia Spain, Amazon Spain, AliExpress, Decathlon Spain, IKEA Spain, Leroy Merlin Spain.
- Banking, cards and investment — CaixaBank Consumer, Financiera El Corte Inglés, ING Spain, Openbank Spain, WiZink Spain, Revolut, Trade Republic, Raisin.
- Other — Bip&Drive (toll invoices), Hover (domain receipts).
Technology
JavaScript (Manifest V3), no framework and no TypeScript. Chrome/Chromium and Firefox. Packaged with npm (npm run package), with an MV3 ZIP attached to each release. A broad test suite (node:test) and CI/CD via GitHub Actions.
Installation
- Chrome / Chromium (Chrome, Edge, Brave, Opera…) — Chrome Web Store.
- Firefox (128 or newer) — Firefox Add-ons.
- Manual — MV3 ZIP from each GitHub release, or load unpacked from the source tree.