Last updated: September 9, 2026
Browser Mate is a Chrome extension that runs locally in your browser. In the initial BYOK (Bring Your Own Key) release, all communications with language models (LLMs) are made directly from your browser to the provider you configure — OpenAI, Anthropic, OpenRouter, Ollama, or any other compatible endpoint. In this phase, the author/developer does not operate a backend that processes user data.
The Managed tier, with backend, Credits, and BrowserMate-provided providers, is not active yet. An updated version of this policy will be required before that tier becomes available — including identifying the intermediary provider, data handling on the backend, and account deletion rights.
Summary in three points
1. What it reads from pages goes only to the LLM provider you chose — never to Browser Mate servers.
2. Everything else (settings, history, receipts, costs) stays on your device and can be deleted by you.
3. There is no telemetry, analytics, or tracking of any kind.
API keys for LLM providers are stored encrypted in your browser. They are never sent to the author's servers.
Your interaction history with the assistant is stored locally in chrome.storage.local. You can delete it at any time through the extension's interface.
When the conversation manager is enabled (on by default), history is organized into separate conversations, each with a title and its own messages. What is never part of that history: API keys, extension settings, receipts, page context, screenshots, attachments, and tool arguments/results. Before anything is written to storage, message text is scanned by a heuristic filter that replaces high-confidence secret patterns (API keys, Bearer tokens, AWS/GitHub tokens, JWTs, private key blocks) with a [REDACTED] marker. Because redaction is heuristic, free text may still contain sensitive information the patterns do not recognize — please do not paste secrets into chats.
The local history is capped (30 conversations, 80 messages per conversation, and a total storage budget); when the message or storage budget limit is reached, new writes are rejected with a clear message, and starting a new conversation with 30 already saved automatically removes the conversation idle the longest (the oldest update) to make room — always with an explicit notice; nothing is deleted silently.
Deleting a conversation (or the entire history) removes it from storage after confirmation. "Clear all" also discards the frozen backup left by the initial migration.
Whenever Browser Mate performs an action in the browser (clicking, filling in a field, navigating, etc.), a local receipt is stored with a description of the action and the site's domain (with the URL partially hidden). Receipts do not contain the values you typed into fields, the full content of pages, attachments, or screenshots. They are limited to 50 entries and can be deleted manually whenever you wish.
To show you how much you have spent with your LLM provider, Browser Mate stores locally a record for each executed turn, with date and time, provider, model used, and token count. These records feed the Costs tab and are limited to 2000 entries. They do not include the content of conversations or pages, and can be deleted in the interface.
Browser Mate does not send telemetry, analytics, or cookies anywhere. There is no tracking of any kind built into the extension, and the author receives no information about your usage.
To be precise: the receipts and cost records described above are, technically, information about your usage — but they stay exclusively on your device, exist for your benefit (transparency and cost control), and can be deleted by you at any time.
Data is stored in your browser, through the mechanisms Chrome makes available to all extensions:
chrome.storage.local — persistent data: settings, encrypted API keys, conversation history, execution receipts, cost records, and per-action confirmation preferences ("Don't show this warning again" — a list of warnings you chose to mute; restorable at any time in the Privacy tab).chrome.storage.session — temporary data for the current turn: pending confirmations, requests for human intervention (handoff), and questions to the user. This area is volatile: it is cleared when you close the browser.Browser Mate does not use chrome.storage.sync. No data is replicated to Google's synchronization servers, nor to BrowserMate servers, cloud services, or remote databases.
API keys are stored encrypted with AES-GCM, never in plain text. The encryption key is derived with PBKDF2 (100,000 iterations, SHA-256) from the extension's identifier, with a random salt generated on first use.
We want to be precise about the scope of this protection. This is not password-based encryption: Browser Mate does not ask you for a password, and therefore cannot require one to read the keys. The encryption protects against casual reading of the storage — for example, by other software that inspects profile files — but anyone with access to your Chrome profile, with your session signed in, can obtain the keys.
Your effective protection is therefore the same as the one protecting passwords saved in your browser: the security of your user account and your device. If you share your computer, use separate Chrome profiles.
The content sent to the LLM provider you choose is governed by that provider's terms and privacy policy.
Browser Mate does not share data with its own servers in the BYOK release.
The extension makes exactly three types of external communication, and no more:
This is the main communication. When you submit an instruction, the extension transmits the page context, attachments, and your instructions to the provider you chose and configured. When the send screenshots setting is enabled (the default), page screenshots captured during your request may also be included in what is sent to the provider. The possible recipients are only these:
| Provider | Destination |
|---|---|
| OpenAI | api.openai.com |
| Anthropic | api.anthropic.com |
| OpenRouter | openrouter.ai |
| Ollama | localhost — does not leave your computer |
| Custom endpoint | The address you provide |
The specific recipient is always the one configured in the settings. These communications are governed by that provider's terms of service and privacy policy. The Browser Mate author neither mediates them nor has access to their content.
When you click the Test Connection button — or when the assistant needs to verify the selected model's capabilities during use — the extension queries OpenRouter's public model catalog (openrouter.ai/api/v1/models) to determine whether the selected model accepts images or files. This happens regardless of which provider is configured.
This lookup:
The Costs tab lets you choose the currency used to display the estimated cost of the current session (default: EUR). When you pick a currency other than EUR, the extension fetches daily reference exchange rates (European Central Bank reference rates) from frankfurter.dev, with open.er-api.com as a fallback service.
This lookup:
Cost accounting itself is unaffected: historical costs, receipts, and model prices remain in euros and on your device.
The extension does not embed third-party services (CDNs, external fonts, analytics scripts, or monitoring SDKs), and does not load or execute code obtained from the Internet.
Browser Mate requests the following permissions. Here is the reason for each one:
| Permission | Purpose |
|---|---|
sidePanel | Open the assistant interface in Chrome's side panel. |
storage | Store conversation history, action receipts, cost records, and settings locally. |
host_permissions (all URLs) | Allow the assistant to interact with web pages when you ask it to automate tasks. Access is only initiated by an explicit user request. |
tabs | Know which tab you are working on and, when asked, switch tabs or navigate to another address. |
alarms | Prevent Chrome from suspending the assistant in the middle of a long task. In Manifest V3, regular timers are throttled in the background; a periodic alarm is the only reliable way to keep a task running to completion. |
scripting | Execute automated actions (clicking, filling in forms, extracting content) on the pages you authorize. |
debugger | Allow interaction with complex editors, such as canvas and iframes, through Chrome input events during an explicit action. While active, Chrome shows a visible notice at the top of the tab. |
None of these permissions is used to collect or transmit your data.
host_permissions (<all_urls>)Browser Mate is a browser automation agent: its purpose is to execute, on the site you are visiting, the actions you ask it to perform (clicking, typing, navigating, extracting content). For that, it needs read and write access to the active page when you submit a request — and there is no way to predefine which sites you will visit.
Universal access is governed by layers of control and consent:
The reason access is not requested domain by domain is practical: an automation agent that required manual confirmation on every new site would make the product's core feature unusable. This is a conscious decision for the first release.
If you have questions, concerns, or suggestions related to privacy, use the contact channel available on the extension's page on the Chrome Web Store. We will respond as soon as possible.
This policy may be updated occasionally to reflect changes in how the extension works or legal requirements. The date of the most recent version is at the top of this document.
Changes take effect immediately upon publication. If any change modifies how your data is handled, you will be notified within the extension itself — not only through an update to this document.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Browser Mate collects only the data strictly necessary for its single purpose — helping you automate tasks in the browser. Your data is not sold, is not transferred to third parties for purposes unrelated to this functionality, is not used for advertising, and is not used to assess creditworthiness or grant credit.
Document written in English. For any additional clarification, please contact us through the extension's official channels.