Privacy Policy

This Privacy Policy explains how the OverShoulder Browser Reader extension handles data. The extension is used with the OverShoulder desktop app to help AI understand browser context and provide step-by-step guidance.

1. Data We Collect

The extension collects page context data only after first-run consent and while screen sharing is active in the OverShoulder desktop app. When screen sharing is off, no browser page context is collected or transmitted.

When active, the following data may be collected:

• Webpage structure (buttons, links, inputs, and similar UI elements), up to 150 elements
• Page text, up to 2,000 characters
• UI labels, placeholders, and visible values from input fields that are not classified as sensitive by the extension
• The current page URL and page title. Chrome Web Store classifies this as Web history. The extension does not collect a separate list of previous visits.
• Personal or sensitive information that is visible within the collected page content may be included before the client-side redaction described below is applied.

2. Automatic Client-Side Redaction

Before transmission, the extension applies client-side redaction to recognized sensitive patterns in collected page text, UI labels, selectors, placeholders, non-sensitive input values, and page titles. It also redacts common sensitive URL query parameters. Redaction includes:

• Email addresses
• Phone numbers
• Credit card numbers
• U.S. Social Security numbers (SSN)
• Korean resident registration numbers
• JWT tokens and API keys

Redaction is a risk-reduction measure based on recognized patterns. URLs and page identifiers may contain arbitrary values, so it cannot guarantee that every personal, confidential, or sensitive value will be detected or removed.

3. How Data Is Used

Redacted page context is sent to the local service used by the OverShoulder desktop app. When needed to answer your request, relevant browser context may then be included in an encrypted request to the AI provider selected or configured in the desktop app. It is used to understand what you are viewing and provide the requested guidance, not for advertising or sale.

4. Service Providers, Data Sharing, and No Sale

Depending on the model selected or configured in the OverShoulder desktop app, relevant browser context may be processed by one of the following AI service providers solely to provide the requested AI functionality:

• Anthropic (Claude) — Privacy Policy
• OpenAI (GPT) — Privacy Policy
• Google (Gemini) — Privacy Policy
• xAI (Grok) — Privacy Policy
• DeepSeek — Privacy Policy
• Alibaba Cloud (Qwen) — Privacy Policy
• Mistral AI (Mistral) — Privacy Policy

We do not sell or rent Browser Reader data, and we do not share it for advertising, creditworthiness, lending, or purposes unrelated to the extension's single purpose.

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Browser Reader data is used or transferred only as necessary to provide or improve the extension's single disclosed purpose, and not for advertising or unrelated purposes.

5. Data Retention

Turning screen sharing off immediately stops new Browser Reader collection and transmission and clears the current DOM/page-context snapshot from the active in-memory Browser Reader state. It does not delete extension-local consent, the local session identifier, screen-sharing state, or every record that may already have been created through use of the desktop app.

• Browser context already included in a conversation, generated response, or Memory Box entry may remain in local desktop-app storage until you delete it using the app's controls.
• AI service providers may process and retain submitted requests according to their applicable API terms and privacy policies.
• Limited operational logs may retain technical metadata, including request time, status, element count, and page URL or title, under normal security and troubleshooting retention practices. The Browser Reader endpoint does not intentionally write raw page text or full DOM snapshots to long-term logs.

6. User Controls

You have full control over data collection:

• First-run consent and screen sharing toggle — browser page context is collected only after consent and while screen sharing is on; turning it off immediately stops new Browser Reader page-context collection and transmission and clears the active in-memory Browser Reader page snapshot
• Per-site permissions — you grant access to each website individually via a runtime permission prompt
• Remove or clear the extension — removing the extension or clearing its local data removes its consent, session identifier, and sharing state; local conversation and Memory Box records are managed separately in the desktop app

7. Security

The extension sends Browser Reader context to the OverShoulder desktop app through a device-local loopback connection (http://localhost:4173), which does not leave your device. Requests from the desktop app to configured external AI service providers are protected in transit using HTTPS/TLS.

8. Contact

Company: OverShoulder
Product: OverShoulder Browser Reader
Contact: support@overshoulder.ai