Privacy Policy
Last updated 28 August 2026
The short version. ChromeBoost has no servers. It has no accounts, no
telemetry, and no analytics inside the extension. The extension talks to exactly one thing:
an MCP server running on your own computer, over a WebSocket bound to
localhost. Nothing about your browsing is sent to us, because there is no
"us" to send it to.
The one thing you should understand before installing is in section 3: page content that you ask ChromeBoost to read is handed to whichever AI coding agent you are running, and that agent will normally send it onward to its own provider.
1. Who this covers
ChromeBoost is a free, MIT licensed, open source project maintained by an individual developer. This policy covers two things:
- The ChromeBoost Chrome extension, distributed through the Chrome Web Store and through GitHub.
- The chromeboost.work website, which is the page you are reading.
The full source for both is public. If any statement here does not match the code, the code is the truth and the discrepancy is a bug worth reporting.
2. What the extension collects
Nothing is collected by the developer. ChromeBoost operates no backend, no logging service, no crash reporter, and no analytics. There is no network destination that data could be collected at.
The extension opens a single outbound connection, and it is a local one:
| Destination | What travels over it |
|---|---|
| ws://localhost:PORT | The MCP server on your own machine. Commands from your AI agent travel in, and the results of those commands travel back. This connection never leaves your computer. |
The extension stores a small amount of state locally using
chrome.storage.local. It stays in your browser profile and is never
transmitted:
- The position, collapsed state, and visibility of the on-page status panel.
- Which local agent sessions are connected, and on which ports.
- A short random prefix used internally to tag elements during a page operation.
No browsing history, no bookmarks, no form data, and no credentials are stored by the extension.
3. Where page content actually goes
Read this part. ChromeBoost is the hands, not the brain. When you ask your agent to read a page, fill a form, or find a button, the relevant page content is passed to the AI coding agent running on your machine, for example Claude Code, Codex, or Gemini CLI. Those tools send what they receive to their own provider's API in order to think about it.
So while ChromeBoost itself transmits nothing to anyone, the practical result of using it is that pages you point it at can reach Anthropic, OpenAI, or Google, governed by their privacy policies and your agreement with them, not this one. Treat it the same way you would treat pasting a page into a chat window.
Two consequences worth being deliberate about:
- Content is only read when a tool call asks for it. ChromeBoost does not watch, scrape, or index pages in the background, and it does not read tabs you have not directed it at.
- Before page text is returned, it passes through a redaction step that strips high confidence secret patterns such as API keys and JWTs, so that credentials sitting on a dashboard are less likely to end up in your agent's context by accident. This is a safety net and not a guarantee. Do not rely on it to protect something that genuinely matters.
4. Permissions, and why each one exists
Chrome shows a blunt warning at install time. Here is the specific reason for each permission the extension requests:
| Permission | Why it is needed |
|---|---|
| debugger | The core of the product. Clicks, drags, and keystrokes are dispatched through the Chrome DevTools Protocol so they arrive as real, trusted input events. Ordinary synthetic events are silently ignored by many modern web apps. |
| <all_urls> | You decide which sites to automate, so the extension cannot know the list in advance. It acts only on the tab you direct it to. |
| tabs | Listing, opening, switching, and closing tabs on request. |
| activeTab | Reading and screenshotting the tab currently being worked on. |
| scripting | Injecting the content script that performs DOM work such as hit testing, form filling, and shadow DOM traversal. |
| offscreen | Holding the WebSocket connection open. An MV3 service worker is shut down when idle, which would drop the connection. |
| storage | Remembering the status panel position and which local sessions are connected. |
| windows | Focusing and arranging browser windows during multi tab work. |
| downloads | Saving a file when you explicitly ask for a download, and reading back files the agent was told to fetch. |
5. What is never done
- Your data is never sold, rented, or licensed. There is no commercial data relationship of any kind.
- Your data is never transferred to third parties by the extension, other than the local connection described above.
- Your data is never used for advertising, profiling, credit scoring, or any purpose unrelated to the feature you invoked.
- Nothing is done with your data beyond carrying out the single tool call you asked for.
6. The website
The site is a static page hosted on Vercel. Two things about it differ from the extension, and it would be misleading not to say so:
- Google Analytics runs on this website, and only on this website. It records ordinary aggregate visit data such as page views, referrer, approximate region, and browser. It is not present in the extension and it has no visibility into anything you automate. You can block it with any content blocker without affecting the extension at all.
- Vercel, as the host, keeps standard server logs including IP addresses, as any web host does.
- The "buy me a coffee" button links out to Stripe. Payments are handled entirely by Stripe under its own privacy policy. No payment details ever reach this site or the developer, and donating is not required to use anything.
7. Children
ChromeBoost is a developer tool and is not directed at children under 13. No age information is collected, because no personal information is collected.
8. Changes to this policy
If this policy changes in a way that affects how data is handled, the date at the top will change and the revision will be visible in the public commit history of this file. Because the project has no accounts, there is no mailing list to notify, so the git history is the record.
9. Contact
Questions, corrections, or a privacy concern: open an issue at github.com/lordamdal/chromeboost/issues. For anything you would rather not discuss in public, including suspected security issues, see SECURITY.md.