Data and privacy

Remixlet has no server, no account, and no telemetry. What it keeps stays in your browser. What leaves is the page content the agent sends to the AI provider you connected, while you are chatting with it. This page says what that content is and where the limits are. The privacy policy states the same facts formally, and Security architecture explains the mechanisms.

In short#

• Your remixlets, their history, your chats, your settings, and your provider keys stay in your browser. None of it reaches us.
• While you chat, the agent sends your provider what it reads from the page you are working on. That can be anything the page shows you, plus the data the site's own scripts load in the background.
• While it works, the agent can act on the site as you: reload the page, click, open other pages on the same site, and repeat requests the page already made.
• A finished remixlet never calls the model. Its script and stylesheet can reach only its own sites and sites you approved by name, with one narrow exception listed under known gaps.
• A local model keeps page content on your machine.

When the agent reads a page#

The agent reads nothing until you send a message in the chat. It then works only on the tab the chat started on. If you switch tabs, it keeps reading the original one. If that tab closes or moves to another site, it stops. Nothing is read on install or in the background. After you close the panel, the recorder a chat turned on can keep holding that site's responses inside its open tabs for up to an hour. What it holds stays in the page, and the agent cannot read it once the chat is over.

Opening the panel does one thing before you send anything. To show the site's icon, the extension fetches the site's front page and favicon, without your cookies. It does this again for each new site you switch to while the panel is open.

What the agent sends to your provider#

The first time the agent looks at a page in a chat, it reloads the tab so it can record the data the page loads from the start. Anything you had typed into the page is lost to that reload. It then takes a capture, which contains:

• the page's address, title, and markup. If the markup is longer than about 40,000 characters, the model gets a structural outline with short text samples instead, and is told the raw page was withheld;
• a screenshot of the visible part of the page, if the tab is the active one in its window and the model accepts images. A text-only model never receives it;
• the frames on the page, listed by origin only. The markup itself still contains each frame's full address;
• the site's own navigation links;
• a list of the data the page loaded from its APIs. For each endpoint: the host, the path with ids replaced by placeholders, the names of its query parameters, how often it was called, and its size, content type, and status. For text responses it adds the field names and value types, but not the values.

After the capture, the agent asks narrower questions, each with its own size cap. It can:

• find elements and read their text, attributes, and styles;
• read the current value of text fields, text areas, and menus, up to 200 characters each. Password fields read as empty;
• read data the page embeds, such as JSON in a script tag, and the values in the page's own JavaScript variables;
• read the responses the page's scripts received since the page loaded, including from signed-in endpoints and POST requests, with their full addresses. By default it gets the first 4 KB of each, and at most 32 KB;
• repeat a GET request the page already made, with your cookies, and read the answer.

If the page has not changed since the last capture in the same chat, the model gets a one-line note instead of the page again.

There is no filter for sensitive content. If the page shows your bank balance, the model sees your bank balance. The data a site's scripts load often holds more than the page shows, such as your email address, account numbers, or the sign-in tokens the site hands its own scripts, and the agent can read that too. We don't think a filter that recognises account numbers or medical details could be trusted to catch enough to be worth promising. So the first rule is yours: if a page shows something you would not paste into a chat with your provider, don't point the agent at it.

The agent is told to treat everything on the page as data, never as instructions. It is not told to avoid sensitive content, because a rule that lives only in a prompt is not a protection we want to advertise.

What the agent cannot read#

• Cookies, local storage, session storage, IndexedDB, caches, and saved passwords. The tool for reading page state refuses them and tells the agent why.
• Request and response headers, apart from each response's content type.
• What is typed into password fields. One exception: a site's own "show password" button can turn the field into plain text, and if the site does not also mark it as a password field, the agent can read it like any other field.
• The contents of frames from other origins, and closed shadow roots.

What the agent can do on the site#

To find out how a page works and to test its changes, the agent acts on it as you would, signed in as you:

• It reloads the tab: on its first look, and every time it applies a change.
• It clicks elements. A click on a link or a submit button behaves like a real one, so it can follow a link or submit a form. A click that would leave the site is refused.
• It opens other pages on the same site.
• It repeats GET requests the page already made. These normally only read data, but some sites make a GET request change something.

The agent's instructions tell it to click only its own controls or elements it has already examined. That is a rule in its prompt, not a technical limit.

What stays in your browser#

Everything Remixlet keeps is in the extension's own storage on your computer, unencrypted, like the rest of your browser profile:

• your remixlets and every version of them;
• your conversations. A conversation's log includes what the agent read from the page, but not screenshots;
• page captures, up to 20 per site, oldest deleted first. A stored capture holds the full markup and the screenshot, even when the model received only an outline;
• the full addresses of up to 400 recent requests pages made, query strings included, so the agent can refer to them by short ids;
• each remixlet's stored data and log, and 90 days of counts of how often each remixlet ran;
• your settings, your provider keys, and your ChatGPT sign-in.

If you turn on "Allow in Incognito" for Remixlet, a chat in an Incognito window is kept like any other chat, and the chat tells you so.

You can delete a chat from the Chats page in the control center. Deleting a chat deletes its log, the page captures it took, and the request addresses it recorded. Remixlets made in that chat stay installed. "Delete all chats", in the menu beside the Chats heading, deletes every chat and every stored page capture, including captures saved by version 1.0.1, which do not record their chat. A chat that is open in the panel can be deleted once you start a new chat there or close the panel. Deleting a remixlet removes its versions, its stored data, its log, and its permissions. Uninstalling the extension removes everything, because Chrome deletes an extension's storage when you remove it.

Requests the extension makes on its own#

Apart from your provider and the site actions above, the extension makes two kinds of request:

• the icon fetch described under When the agent reads a page;
• when the agent examines the page's design, the stylesheets the page loads from other hosts, fetched without cookies.

There are no analytics, no crash reports, and no remote configuration.

API keys and sign-in#

Provider API keys are stored in the extension's storage and sent only to the provider they belong to, in a request header. They never pass through the pages you visit. Two lint checks guard this: code in the background worker and the page bridge may not refer to a key at all, and no code may put a key or sign-in token into a URL, a log line, or an error message.

A ChatGPT sign-in works differently. The extension's background worker keeps its tokens and renews them when they expire. They are sent only to OpenAI.

Why Remixlet asks for access to every site#

The extension needs permission for every site so it can work on whichever page you choose. That permission does not make it active everywhere. No remixlet runs on a site until you make one for it, and the agent reads nothing from a page until you send a message in the chat there.

Keeping everything on your computer#

Connect a local model, for example one running in Ollama, and page content never leaves your machine. The agent still acts on the site as described above, because that is how it looks at the page.

What a server would mean#

A server may exist one day, most likely to sync your remixlets between browsers. If it does, it will be opt-in. Nothing will leave your machine unless you turn syncing on, and the local-only setup described here stays the default.