Privacy and local data

What stays on the device

Browser Mate uses chrome.storage.local for settings, encrypted keys, history when active, receipts and cost records. It does not use chrome.storage.sync to replicate this data. Temporary confirmation and human-intervention states use session storage and are volatile.

• Receipts: last 50, with metadata about actions and pages; they are not archives of screenshots, attachments or typed values.
• Costs: last 2000 records, with usage and estimates, without conversation content.
• History: stored locally when the Security option is on. Recent conversation context may be sent in subsequent calls to the model.

What may leave the device

The request, page context, attachments and authorized screenshots go directly to the configured endpoint. They do not pass through a Browser Mate AI server. With OpenRouter, that service forwards to the model’s provider. With a localhost server, inference runs locally.

The extension may also query:

• The public catalog openrouter.ai/api/v1/models, for capabilities and prices, with a 24-hour local cache. The query does not send your key or page content.
• api.frankfurter.dev and, as an alternative, open.er-api.com, for exchange rates, with a 12-hour cache.
• Search services supported by the provider, if you allow web search.

These queries are not Browser Mate usage telemetry, but they are network communications: the services may receive normal connection metadata, such as IP. A local model does not guarantee fully offline operation.

Screenshots are not automatically anonymized

Blocking sensitive fields in the DOM does not necessarily hide information in a capture. Turn screenshots off and avoid confidential attachments when you do not want to send them to the provider.

Cleanup options

In Settings → Privacy:

Action	Effect
Clear history	Removes local history. Does not delete copies already sent to providers nor the model settings.
Clear receipts	Removes local receipts; it does not undo recorded actions.
Clear all data	Removes settings, keys and local data, clears session states and cancels turns. Requires confirmation and reloads the panel.
Show confirmation warnings again	Re-enables warnings you chose not to see again. Does not replace enabling action confirmations in Security.
Revoke consent	Requires page-access consent again on next use. It is not a deletion of history.

To prevent new conversation records, turn Save conversation history off in Security, save and reload the panel. There is no separate button on this tab to remove cost records: full cleanup removes them together with the other data.

Key security

Local encryption uses AES-GCM with a key derived via PBKDF2 from the extension identifier and a local salt. It is not protected by a password you provide; access to the browser profile may allow recovering the keys. Protect the device and revoke keys at the provider when needed.

Official policy

Read the published extension policy. That policy differs from the landing page policy, which has contact and access forms. The published policy may not cover all the auxiliary runtime queries described above; this documentation neither replaces it nor promises zero retention by the chosen provider.

The documentation website adds no analytics, tracking, external fonts or third-party scripts. Hosting remains subject to the operator Cloudflare’s normal handling of requests.