Privacy policy — mai browser bridge

Browser extension (Chrome and Firefox) · last updated 15 September 2026

The short version. This extension sends what it reads to
one place: the mai server you point it at, which is normally mai running on
your own computer at 127.0.0.1. There is no developer server, no analytics, no
tracking, no advertising, and nothing is sold or shared with anyone. If your mai runs on your
machine, your data never leaves it.

What it can access

• The content of pages you allow. Every website is refused until you allow
  it by name, once or permanently, from the extension's panel. Until you do, mai can see that
  a tab exists and nothing else.
• Tab titles and addresses, so a session can tell you which tab it is about
  to act on and so you can pick one.
• Console messages and request metadata — method, URL, status, duration —
  but only while you have switched recording on, and never request or response
  bodies and never headers. Automated tests enforce that.
• Which field you focused, when you are recording a flow —
  never what you typed into it. Recordings are made to be shared; values are
  not part of them.

Where it goes

To the WebSocket address you enter in the extension's settings, authenticated with a token
you paste there, and nowhere else. That address is normally your own machine. The extension
contacts no server belonging to the developer, and it contains no analytics, telemetry,
crash-reporting or advertising code of any kind.

It will also fetch a URL when a session explicitly asks it to save a file from a page you
have allowed, and it will download a file from your own mai instance when you ask it to upload
one into a page. Those are the only other network destinations, and both are actions you take.

What it stores, and where

On your device, in Chrome's extension storage. Nothing is stored anywhere else.

• Permanent (chrome.storage.local): the mai address and access
  token, which sites you have allowed, and your switches — paused, raw JS, idle timeout.
• Until you close Chrome (chrome.storage.session): the chat in
  the side panel, a short list of recent actions, and a flow while you record it.

Removing the extension removes all of it.

What it never does

• No selling or sharing of your data — there is nobody to sell it to.
• No use of your data for advertising, profiling, or training models.
• No reading of a site you have not allowed.
• No recording of typed values, request bodies, or headers.
• No silent activity: anything mai does in your browser is listed in the panel, the
  toolbar names the session driving each tab, and recording shows a banner on the page for
  as long as it runs.

Why it asks for each permission

Websites (all sites)mai has to be able to reach whichever site you are working
on. Access is still refused per site until you allow that site yourself.
tabsTo list your tabs, name the one it will act on, and follow the one you pin.
scripting / activeTabTo read a page and to click and type in it, on your instruction.
debuggerScreenshots, and running JavaScript when you explicitly switch that on.
Chrome shows its own banner whenever this is in use.
storageTo keep the settings and grants above.
tabGroupsTo put the tabs mai opens into a labelled group, so you can see which
tabs are its doing.
sidePanelThe chat panel beside the page.
alarmsTo notice an idle session and disconnect it.

You are in control

Every site is blocked until you allow it, and can be revoked at any time from the panel.
Pause refuses everything that moves the page, immediately. Running arbitrary
JavaScript is off unless you switch it on. The extension disconnects itself after a period of
inactivity you choose.

Children

This is a developer tool and is not directed at children under 13.

Changes

If this policy changes, the date at the top changes with it, and the change ships with a new
version of the extension.

Contact

Write to the developer address shown on the extension's Chrome Web Store listing.

mai browser bridge is part of mai.
Its use of any information received from Google APIs adheres to the
Chrome Web Store
User Data Policy, including the Limited Use requirements.