Privacy policy — mai browser bridge
Chrome extension · last updated 15 September 2026
The short version. This extension sends what it reads to
one place: the mai server you point it at, which is normally mai running on
your own computer at 127.0.0.1. There is no developer server, no analytics, no
tracking, no advertising, and nothing is sold or shared with anyone. If your mai runs on your
machine, your data never leaves it.
What it can access
- The content of pages you allow. Every website is refused until you allow it by name, once or permanently, from the extension's panel. Until you do, mai can see that a tab exists and nothing else.
- Tab titles and addresses, so a session can tell you which tab it is about to act on and so you can pick one.
- Console messages and request metadata — method, URL, status, duration — but only while you have switched recording on, and never request or response bodies and never headers. Automated tests enforce that.
- Which field you focused, when you are recording a flow — never what you typed into it. Recordings are made to be shared; values are not part of them.
Where it goes
To the WebSocket address you enter in the extension's settings, authenticated with a token you paste there, and nowhere else. That address is normally your own machine. The extension contacts no server belonging to the developer, and it contains no analytics, telemetry, crash-reporting or advertising code of any kind.
It will also fetch a URL when a session explicitly asks it to save a file from a page you have allowed, and it will download a file from your own mai instance when you ask it to upload one into a page. Those are the only other network destinations, and both are actions you take.
What it stores, and where
On your device, in Chrome's extension storage. Nothing is stored anywhere else.
- Permanent (
chrome.storage.local): the mai address and access token, which sites you have allowed, and your switches — paused, raw JS, idle timeout. - Until you close Chrome (
chrome.storage.session): the chat in the side panel, a short list of recent actions, and a flow while you record it.
Removing the extension removes all of it.
What it never does
- No selling or sharing of your data — there is nobody to sell it to.
- No use of your data for advertising, profiling, or training models.
- No reading of a site you have not allowed.
- No recording of typed values, request bodies, or headers.
- No silent activity: anything mai does in your browser is listed in the panel, the toolbar names the session driving each tab, and recording shows a banner on the page for as long as it runs.
Why it asks for each permission
| Websites (all sites) | mai has to be able to reach whichever site you are working on. Access is still refused per site until you allow that site yourself. |
| tabs | To list your tabs, name the one it will act on, and follow the one you pin. |
| scripting / activeTab | To read a page and to click and type in it, on your instruction. |
| debugger | Screenshots, and running JavaScript when you explicitly switch that on. Chrome shows its own banner whenever this is in use. |
| storage | To keep the settings and grants above. |
| tabGroups | To put the tabs mai opens into a labelled group, so you can see which tabs are its doing. |
| sidePanel | The chat panel beside the page. |
| alarms | To notice an idle session and disconnect it. |
You are in control
Every site is blocked until you allow it, and can be revoked at any time from the panel. Pause refuses everything that moves the page, immediately. Running arbitrary JavaScript is off unless you switch it on. The extension disconnects itself after a period of inactivity you choose.
Children
This is a developer tool and is not directed at children under 13.
Changes
If this policy changes, the date at the top changes with it, and the change ships with a new version of the extension.
Contact
Write to the developer address shown on the extension's Chrome Web Store listing.