Connect My AI helps you connect AI tools to browser tabs with user-selected browser permissions. This Privacy Policy explains what data the website, dashboard, hosted service, browser extension, and desktop companion process during the current release.
Data We Process
Connect My AI may process account email, subscription and access status, browser extension and desktop companion status, URLs and tab titles, local tab-recovery snapshots, visible page text, page state, screenshots, form state, files you choose for a requested upload, action requests and results, timestamps, permission settings, approval or denial records, activity and diagnostic information, and support ticket or Help Assistant details that you choose to send.
Sensitive Data
The extension attempts to detect sensitive fields such as password, credit card, banking, address, private, token, and account-number fields. These checks are safeguards, not a guarantee that every sensitive field will be detected. Do not intentionally store passwords, credit card numbers, authentication tokens, private keys, or private secrets in prompts, support tickets, workflow recipes, or saved instructions.
Read only prevents page changes. Ask when needed prompts for protected actions. Trust this session and user-selected Extended access can cover routine browser work without repeated Connect My AI prompts; session trust ends with the browser or desktop session, while Extended access remains until you turn it off. Within Connect My AI's browser-action permission model, only the resolved final action that irreversibly spends, sends, transfers, trades, donates, or otherwise commits money always requires a fresh, exact-target confirmation. Browser permission dialogs and human-verification checks can still require your direct action.
Connect My AI does not store website passwords. Sign-In Assist can focus login fields and may perform an optional one-time, origin-checked fill into the matching browser tab, but passwords are not saved to Connect My AI servers or returned to AI tools.
Respect My Tabs snapshots are stored locally by the extension or desktop companion. They contain URLs and basic tab/window state for recovery, not page contents, passwords, form entries, or payment information.
How Data Is Used
Data is used to carry out browser tasks under your selected permission, deliver task-requested output to your selected AI, show connection health and action status, enforce permissions and policies, maintain permission records and audit trails, support security reviews, respond to support requests, verify subscription access, and provide optional AI-assisted help responses.
Data Sharing
At your direction, Connect My AI sends the page data and task output that your selected AI requests to that AI so it can perform the task. Your selected AI may run locally on your device or may be operated by a third party; that provider's privacy terms and your configuration govern what it does with data after receiving it.
Connect My AI does not sell personal data or browsing data and does not use browsing data for advertising. Other data sharing is limited to service providers needed to operate the product, such as payment processors, hosting and database providers, authentication providers, email and ticket-routing providers, and optional AI support providers when Help Assistant is enabled.
Storage and Retention
The public hosted service stores server-side operational records in a production PostgreSQL database. The browser extension and desktop companion use browser or desktop local storage for local settings and companion features. Development or self-hosted builds may instead use an operator-controlled local store.
- Account records include your email, subscription state, Terms acceptance status, and session metadata. User sessions expire based on the configured session lifetime.
- Magic links are stored as hashes, expire, are single-use, and are bounded by the service. The configured magic-link window controls the expiry time.
- Browser pairing codes are stored as hashes, expire, are single-use, and are bounded by the service. The current pairing window is about 10 minutes.
- Audit, permission, action-queue, and action-status records are bounded and record operational events such as login, pairing, policy changes, approvals, revocation, browser-action delivery, and results.
- Support tickets are bounded and may also be sent by email when support email delivery is configured.
- Extension diagnostics are limited to the relevant account and redacted for support. Public diagnostics do not expose active tab URLs or page content.
- Permission records, settings, site authorizations, recent action receipts, and tab-recovery snapshots in the extension and desktop companion are bounded locally.
- Raw page content is processed only when requested and is not retained by default. It may be included in a task result, a support ticket you submit, or a local diagnostic record. Exact authorized private action results, when stored for task retrieval, use a limited owner-scoped vault with a default 24-hour availability period and can be deleted early.
- Server-side extension and agent tokens are stored as hashes. Stored signing secrets and private action-result payloads are protected with authenticated application-layer encryption before storage in the public hosted commercial service. The browser extension keeps its own limited-use connection credentials in extension-local storage so it can authenticate signed work; you can revoke or rotate them.
Connect My AI keeps operational records limited and reviewable.
User Control
You can choose Read only, Ask when needed, Trust this session, or Extended access; pause browser control; trigger Panic Stop; block sites; clear approvals; revoke browser extension access; rotate or revoke AI-agent credentials; and request support.
Browser API Limited Use
The use of information received from browser APIs and connected services is limited to providing and improving Connect My AI's single purpose: user-approved browser automation for user-selected AI tools. We do not use browsing data for advertising or sell browsing data.
The use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Security
Action requests are signed by the server and verified by the extension before execution. Agent credentials are token or HMAC based. The public hosted service protects server-side credentials with token hashing, authenticated encryption for stored signing secrets and private action-result payloads, limited-use credentials, revocation, secure cookies, origin checks, and rate limits. Local browser and desktop records remain protected by your device, browser profile, operating-system account, and the product's revocation controls.