Browser Agent Privacy Notice

Overview

Browser Agent is a Chrome Side Panel extension that reads and helps operate the current web page in response to the user's instructions. This is its single purpose.

Browser Agent has no Publisher-operated remote service for task processing, analytics, telemetry, diagnostic uploads, model traffic, or Capability Service or MCP hosting. All remote task-data processing initiated by the Extension is performed by providers or services configured and selected by the user.

Task history, configuration, and conversation state are stored in the user's own browser. The Publisher does not receive or use this locally stored task data. Remote requests go directly to the services the user chooses, without passing through the Publisher.

When the user starts a task, the Extension sends the task and the page representation needed to perform it directly to the selected model provider. If the user enables and selects an optional Capability Service or MCP connector, the Extension also sends the requests described below directly to that service. The production Extension does not provide, preconfigure, select, endorse, or operate a Capability Service or MCP server.

The Extension does not automatically send the Publisher task text, page content, model, Capability Service, or MCP requests and responses, API keys, Connector credentials, telemetry, or diagnostics. The Publisher may receive information the user separately chooses to provide, such as an email or a Chrome Web Store review, but that is outside the Extension's task-data flow.

In this notice, local describes data stored in Chrome storage or IndexedDB assigned to the Extension in the user's browser profile. When a task starts, necessary data stored or prepared locally may be transmitted directly to the providers selected by the user. It is not transmitted to the Publisher.

Data the Extension handles

Depending on the features the user chooses, Browser Agent may handle:

• Task and conversation data: task text, selected-text attachments, model responses, execution results, and bounded conversation summaries.
• Current-page data: the locked tab's URL, domain, title, favicon metadata, page structure, visible or otherwise agent-accessible page text, element metadata, and observations produced by requested page actions.
• Model configuration and authentication data: provider name, provider Base URL, model names, API keys, model settings, and the selected provider and model.
• Extension settings and grants: language, theme, approval mode, page-highlighting and context settings, enabled Capability Service and MCP connections, per-source tool and data grants, and the page, provider, and service origins the user has granted.
• Task-history metadata: status, selected model, token counts, step counts, timing information, and minimized execution events.
• Optional Capability Service data: locally assigned source identifiers, display names, service URLs, enabled and active state, API keys, credential fingerprints, short-lived tokens, downloaded protocol declarations and revisions, per-source grants, resource identifiers, revision hints, structured Tool inputs and results, proposed changes, approval state, commit results, and reconciliation data.
• Optional MCP connector data: connection identifiers, display names, endpoint URLs, account labels, authentication settings, Bearer tokens or custom authentication headers, timeouts, protocol options, tool descriptions and schemas, discovery status, tool-review records, grants, and tool arguments and results.

Page content, selected text, tasks, and structured results may contain personal, confidential, or sensitive information belonging to the user or another person. Users should not start a task on a page, or attach text, unless they are authorized to process that information and are willing to disclose the necessary content to their configured providers.

How the data is used

The Extension uses this data only to:

• provide the user-requested current-page assistant and automation features;
• generate and display model responses and task progress;
• restore the correct task view when the user moves among already-open tabs;
• keep bounded local history and continuous-conversation context;
• test and use the model provider, Capability Services, and MCP connectors selected by the user;
• apply page-action and WritePlan approval controls;
• surface failures to the user; and
• enforce the Extension's permission, approval, security, and response-size limits.

The Extension does not transmit task or page data to the Publisher for model training, product analytics, advertising, profiling, market research, data brokerage, creditworthiness decisions, or any other purpose.

Data stored on the device

Model and Extension configuration

The following data is stored in chrome.storage.local until the user removes it or uninstalls the Extension:

• model provider URLs, names, models, API keys, and model settings;
• Extension preferences;
• Capability Service profiles, including locally assigned identifiers, display names, service URLs, enabled and active state, API keys, and per-source capability and data grants;
• MCP connection identifiers, display names, endpoint URLs, account labels, authentication mode, timeout and protocol settings, discovery timestamps and counts, tool-review digests, and grants; and
• recorded page, provider, and service origin grants. Chrome separately manages the corresponding optional host permissions.

Short-lived model and control tokens for each Capability Service, and MCP Bearer tokens and custom authentication header names and values, are stored in chrome.storage.session, not durable local storage. Chrome clears session storage when the browser restarts or the Extension is disabled, reloaded, or updated. Authenticated MCP connections then require credentials to be entered again; saved connection settings and tool reviews remain local.

Tab task routes, sanitized live results, and other task-owned UI state may also remain in session storage so the correct view can be restored during the current browser session.

Upgrading an older MCP configuration may retain a local backup of its non-secret connection and review settings. This backup does not contain Bearer tokens or custom authentication headers and remains until the user clears the configuration or uninstalls the Extension.

Task history

Task history is stored in the Extension's local IndexedDB database. A task record can include the user's task text, page title and URL, domain, minimized execution events, final result or safe Capability summary, selected model, status, token counts, and timing information.

Task records expire 30 days after they are saved. Expired records are deleted when the Extension next reads the record, lists or saves history, or runs history cleanup. Cleanup does not run while the Extension is inactive, so expired records can remain on the device until that next access. History cleanup also applies the following local limits:

• no more than 200 task records;
• no more than 25 MiB across task records; and
• no more than 512 KiB for one task record.

Older records are removed first during cleanup when an age, count, or storage limit is reached.

Common credential fields, data-entry values, and token-shaped values are redacted or omitted before a task record is written or exported. Redaction reduces accidental retention but is not guaranteed to identify every secret or every item of personal information.

Capability Service and MCP tool-event inputs and results are omitted or reduced to bounded metadata before durable history storage and export. This includes raw Dataset rows, filters, write values, and WritePlan previews in tool-event payloads.

The user's task text and the model's final answer are retained locally after redaction, including answers based on connected-service data. Those answers may contain document content, query results, or other information from the task. They can appear in IndexedDB history and user-created history exports. Minimizing raw tool events does not remove that information from the final answer or from the bounded conversation summaries described below. Sanitized results may also remain in session storage for restoring task views; a tab route itself contains only routing metadata.

Continuous-conversation state

For ordinary web pages and supported Capability resources, IndexedDB stores bounded continuous-conversation state. It can include up to five recent redacted user intents, redacted answer summaries, selected-text excerpts of up to 600 characters per turn, a bounded rolling summary, resource identifiers and revision hints, and write-plan status entries. These summaries and excerpts can be sent to the selected model provider in later tasks to support follow-up requests. Ordinary-page conversations are scoped to the current Side Panel session and tab; ending that session does not immediately delete their stored records.

This state expires seven days after its last update and is deleted when the Extension next loads or prunes the expired conversation. Starting a new conversation archives the previous state until its existing expiry; it does not immediately erase it.

Selected-text attachments

While the Side Panel is open on an explicitly permitted page, a tab-scoped content-script port observes the user's current text selection and projects it directly into that tab's in-memory Composer draft. The observer exists only while the port is connected, and this live path does not persist the selection.

When the Side Panel is closed, Ask Browser Agent provides an explicit context-menu path. Its pending chrome.storage.session handoff expires after 60 seconds. The Extension removes the entry after consumption, after a handled panel-open failure, when the source tab closes, or when an expired entry is next read. Chrome clears any remaining entry when the Extension or browser session ends.

The full attachment is not appended to the durable task-text field. After a task starts, the Side Panel may quote it under the sent task in memory. When a conversation turn is saved, the Extension also stores a redacted excerpt of up to 600 characters directly in local IndexedDB. This excerpt can be reused as historical context in later model requests and follows the conversation expiry and deletion rules above.

Model output and execution summaries may quote or derive information from the attachment and can therefore appear in local task history, conversation state, session-scoped task snapshots, or user-created history exports.

Data sent to the configured model provider

When a task runs, the task text and page representation needed to plan and perform it are sent directly from the Extension to the OpenAI-compatible endpoint configured by the user. Depending on the task, a model request can also include:

• a selected-text attachment;
• bounded continuous-conversation summaries and historical selected-text excerpts;
• page-action observations; and
• descriptions and schemas of available tools, and text or structured results returned by selected Capability Services or MCP connectors, including document blocks, Dataset rows or aggregates, canvas text, resource metadata, and write-plan outcomes.

Selected text, prior conversation context, and connected-service content are marked as quoted, untrusted context for the model, but they are still disclosed to the configured provider.

A model connection test sends the configured API key to the provider in an authorization header and requests the provider's model list. Browser Agent does not proxy ordinary model traffic through a publisher-operated service. The configured model provider's terms, retention policy, security controls, location, and human-access practices apply.

Browser Agent does not send page content to a model provider while it is idle.

The Extension accepts user-configured HTTP and HTTPS model endpoints. HTTPS encrypts data in transit; HTTP does not. HTTP should be used only with a loopback development service controlled by the user. Users should not send page content or credentials to a remote HTTP endpoint.

Data sent to user-configured third-party Capability Services

Capability Services are optional and disabled by default in production builds. Browser Agent uses only Capability Service profiles and credentials supplied by the user. The Publisher does not provide, preconfigure, select, endorse, or operate those services. When the user enables and selects a source, or explicitly tests its connection, the Extension can contact that source to validate the configuration, exchange its saved API Key for short-lived session tokens, and download its governed Tool protocol. The downloaded protocol consists of declarative metadata, schemas, endpoint bindings, and policy declarations; the Extension does not download or execute third-party JavaScript from a Capability Service.

Outside configuration and connection testing, only a source selected for the task and allowed by the user's per-source grants receives Capability requests. Depending on the selected Tool, this can occur for a supported current page, an explicitly bound resource, or a page-independent request. The Extension may send:

• the user's task text or structured Tool arguments required for the selected capability;
• the locked page URL and resource identifiers;
• document, Dataset, Bitable, metrics, or canvas read queries;
• filters, columns, aggregates, limits, block IDs, node IDs, and revision hints;
• proposed document content, Dataset values, view changes, or canvas text;
• approval, commit, idempotency, and reconciliation data for a WritePlan.

The selected service can return structured document content, Dataset rows or aggregates, canvas text, resource metadata, Tool metadata and results, and write-plan previews or outcomes. Returned read data needed by the agent may subsequently be sent to the configured model provider as described above.

A configured Capability Service may declare Connector authorization flows. The Extension does not request or store Connector OAuth credentials. Those credentials are handled by the service selected by the user, under that service's own terms. For the currently supported Feishu flow, the Extension may open a user-controlled authorization tab only after informing the user and requesting approval; the model cannot open that tab.

For compatible services, the model and UI use separate short-lived tokens. The model token can read and propose only; the control token is used by Settings and the WritePlan approval UI. The operator of each configured third-party Capability Service, rather than the Publisher, determines its server logs, retention, support access, security, identity, Connector credential handling, and international-transfer practices. Its terms, and the terms of connected services such as Feishu, also apply. Users should review those terms before enabling the integration.

Data sent to user-configured MCP connectors

MCP connections are optional and supplied by the user. Connecting and discovering tools sends client and protocol metadata, plus configured authentication credentials, directly to the chosen endpoint. Discovery downloads tool descriptions and schemas; it does not authorize tool execution or download executable plugins. MCP currently supports anonymous connections, manually supplied Bearer tokens, and custom authentication headers. It does not perform an MCP OAuth login flow.

During a task, enabled connections may be contacted for discovery. Calling a tool additionally requires the user's saved tool authorization and local review of that tool as read-only. A call sends the tool name and validated arguments directly to its configured endpoint. The model may include information from the task, page, selected text, conversation, or earlier tool results in those arguments. Read-only review does not prevent this disclosure or guarantee how the remote service behaves. Returned text or structured results may then be sent to the chosen model provider and appear in local answers and summaries as described above.

The explicit read-tool test in Settings sends only the tool arguments shown in the test form, along with protocol metadata and configured authentication. It does not automatically attach page content or conversation history, call the model provider, or save the test's arguments and result to task history or conversation storage. The test form and its result remain in memory while that form is mounted.

MCP requests omit browser cookies and reject redirects to another endpoint. Connection diagnostics use bounded metadata such as tool names, discovery counts, error categories, and HTTP status codes; they are not automatically uploaded to the Publisher. Each user-selected MCP operator determines its own logging, retention, security, and downstream data processing under its own terms.

Page access and Chrome permissions

The Extension requests only the Chrome permissions used by its current features:

• sidePanel: displays the Extension interface in the Chrome Side Panel.
• tabs and activeTab: identify the active tab, show current-page metadata, request user-initiated access, and lock a task to its starting tab.
• scripting: registers the page controller after the required site access is granted.
• storage: stores the local and session data described in this notice.
• contextMenus: provides the user-initiated Ask Browser Agent selected-text action.
• Optional HTTP(S) host permissions: access a specific page, configured model provider, or configured Capability Service or MCP endpoint only after the user grants that origin.

The content script can read and interact only with explicitly permitted regular HTTP and HTTPS pages. It refuses restricted browser pages such as chrome://, the Chrome Web Store, extension pages, and local browser settings.

For each ordinary task, control is locked to the tab that was active when the task started. The model has no tools to create, switch, close, or group tabs. The Extension does not expose a control API to page JavaScript and does not provide arbitrary JavaScript execution.

External actions and approvals

Depending on the selected approval mode, Browser Agent pauses before permitted page actions. The default mode asks before high-risk permitted actions such as submitting, sending, deleting, publishing, changing an account, or entering sensitive information.

Purchases, payment actions, automatic ordering, file uploads, and arbitrary script execution are blocked in this version; they cannot be enabled through an approval decision.

Governed Dataset, Bitable, Document, and Canvas writes require a separate WritePlan approval, regardless of the selected page approval mode. The Extension displays the exact target and a masked preview, then approves and commits only the reviewed plan. It does not automatically retry a write whose result is unknown.

Sharing, disclosure, and sale of data

Model and connector requests go directly to the model provider, Capability Services, and MCP endpoints configured and selected by the user, as described above. Those providers process the data under their own terms. User-requested page actions may also submit data to the locked website, subject to the page-action controls above. The Extension does not send a copy of these requests or local task data to the Publisher.

Contacting the Publisher or posting a store review is separate from running the Extension. If the user chooses to provide contact details, messages, screenshots, history exports, logs, or other information, the Publisher uses it only to respond to or investigate that communication, or to comply with applicable law. The Extension has no automatic support-reporting, telemetry, or diagnostic-upload function. Users should redact information that is not needed for their request.

The Publisher does not sell user data or transfer it for advertising, retargeting, data brokerage, unrelated profiling, or creditworthiness decisions.

Google may independently process Chrome Web Store installation, review, rating, and developer data under Google's own privacy terms. The Extension does not send task or page content to Google merely because it is distributed through the Chrome Web Store.

Security

Browser Agent uses origin-specific permissions, task-to-tab locking, bounded storage and responses, credential redaction, separate short-lived Capability tokens, and explicit write approval controls to reduce risk.

Model-provider and Capability Service API keys are stored in chrome.storage.local; MCP Bearer tokens and custom authentication headers use session storage as described above. Browser Agent does not provide a hardware-backed secret vault or additional application-layer encryption for these locally stored credentials. Chrome and the operating system's browser-profile protections apply. Users should use restricted, revocable credentials, rotate them when appropriate, and remove them from Settings on a shared device.

Remote model, Capability Service, and MCP connections should use HTTPS. Capability Service and MCP configuration reject non-loopback HTTP endpoints, but the model-provider configuration currently permits user-selected HTTP endpoints as described above. No transmission or storage system can be guaranteed completely secure.

User choices and deletion

Users can:

• decline a page, model-provider, Capability Service, or MCP origin permission, or revoke it through Chrome's extension settings;
• disable page-context attachment;
• leave every Capability Service and MCP connection disabled;
• enable, select, disable, or remove an individual Capability Service and its local credentials, grants, and session;
• disable or remove an MCP connection, or revoke its tool authorization;
• stop a running task;
• delete one task record or clear all task history;
• erase the continuous-conversation state for the current page or supported resource;
• clear all saved model, Capability Service, and MCP configurations and credentials; or
• uninstall the Extension to remove Chrome-managed extension storage.

The deletion controls have the following boundaries:

• Settings → Clear configuration removes model-provider configuration and API keys, all Capability Service profiles, credentials, grants, and session tokens, plus MCP connections, reviews, grants, session credentials, and the older MCP configuration backup. It does not remove task history, continuous-conversation state, preferences, or page-access grants.
• Remove an MCP connection removes that connection's active configuration, tool reviews, grants, and session credentials. It does not erase existing task history or conversation state. An older configuration backup, if present, is removed by Clear configuration or uninstalling. Disabling a connection preserves its saved settings and reviews.
• History → Clear all removes saved task records and browser-session task views. The Side Panel where the action is confirmed also resets its current task/result and selected-text quotes from sent tasks. Unsent Composer text and selected-text attachments are preserved. Another already-open Side Panel can retain its own in-memory view until it is reset or closed. This action does not clear continuous-conversation state.
• Erase conversation removes the active continuous-conversation state for the current page or supported resource. Other conversations remain until individually erased or expired and subsequently pruned. Archived records are not removed by this action; they remain until expiry and subsequent cleanup or uninstalling.
• History exports are files or clipboard copies created at the user's request outside Extension storage. Clearing History or uninstalling the Extension does not delete copies already saved to Downloads, the clipboard, backups, or another application.
• Uninstalling the Extension removes its Chrome-managed extension storage. It does not instruct a configured model provider, Capability Service, MCP operator, Connector provider such as Feishu, or another recipient to delete data they retain under their own terms.

Where applicable law provides rights to access, correct, delete, restrict, object to, or obtain a copy of information the user intentionally sent to the Publisher, the user may contact the Publisher using the details above. For task data retained by a configured model provider, Capability Service, MCP operator, or Connector provider, the user should contact that provider. The Publisher does not control those providers' retained data.

International data processing

The user's configured model provider, Capability Services, MCP operators, or Connector providers such as Feishu may process data outside the user's country or region. Their own privacy terms and transfer mechanisms apply. Users should review those terms before configuring or authorizing a service.

Children

Browser Agent is not directed to children under 13 or to children below the minimum age established by applicable law. The Extension does not send children's personal data to the Publisher during ordinary operation. A parent or guardian who believes a child separately sent personal data to the Publisher may contact the Publisher using the details above.

Chrome Web Store Limited Use commitment

The use and transfer of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Browser Agent uses information received from Chrome APIs only to provide its disclosed single purpose and the directly related security and reliability functions described in this notice. The Extension does not transfer this information to the Publisher. All other uses, transfers, and sales are prohibited except as expressly permitted by the Chrome Web Store User Data Policy and applicable law.

Changes to this notice

The Publisher may update this notice to reflect changes to the Extension, connected services, law, or security practices. The date at the top will identify the latest version.

If an update introduces materially different data-handling practices, the Publisher will disclose the change prominently through the Extension interface, Chrome Web Store listing, or another visible channel before the new practice begins and will obtain affirmative consent where required.