Browser Extension Privacy Policy

1. Single purpose

The AgentValet browser extension exists to help you create and connect a scoped API credential for an AI agent. Every permission it requests, and everything described below, serves that one purpose. The extension helps you create a new credential; it does not capture your existing logins.

2. What is collected

The platform ids you tick

When you check a box next to a product in the popup, that selection is held in the popup's memory for as long as the popup stays open, so it drives what "Detect automatically" and "Connect" act on. It is not written to disk: closing the popup discards it, and reopening the popup starts with nothing ticked. It never leaves your browser on its own.

A signed-in true/false per ticked platform, only if you press "Detect automatically"

This button is off by default and requires its own permission grant, requested at the moment you press it, scoped only to the products you already ticked. Pressing it checks whether a sign-in cookie exists for each ticked product's own site. The extension reads only whether the cookie is present, never its value. The result is held in the same popup-session memory as your ticks, shown to you, and discarded when the popup closes. It is not sent anywhere.

The credential you create

When a product's token page shows you a newly created token, the extension reads that one value and sends it once to your AgentValet account over an encrypted connection, so the connection can be set up. The extension does not keep a copy: it is not written to browser storage, not logged, and not retained by the extension after that single transmission.

The list of products AgentValet can govern

The extension caches this published catalog locally in the browser so the popup has something to show before it can reach the network. It describes AgentValet's product support, not you, and contains no information about which products you use or have ticked.

3. What is never collected

• Cookie values. The extension can check whether a cookie exists; it never reads what the cookie contains.
• Request or response headers. The extension has no request-observation permission at all, so it cannot see network traffic on any page.
• Page contents. The guidance panel the extension shows on a product's token page is injected only after you press Connect for that one page, and it does not read the page around it beyond the single field where a freshly created token appears.
• Browsing history. The extension does not track which sites you visit, and it has no permission that would let it.

4. Where data goes

The platform ids you tick and the signed-in booleans stay only in the popup's in-memory state while it is open. They are not written to disk, not written to persistent browser storage, and not transmitted anywhere. Closing the popup discards them.

Your AgentValet sign-in uses your account's own sign-in flow. The extension never sees your password and holds only a short-lived, in-memory session token that is cleared when the browser closes.

The credential you create is sent once, to your AgentValet account, over an encrypted connection, at the moment you create it. It is not sent to, or processed by, anyone else.

5. Consistency with the in-popup disclosure

Before the "Detect automatically" button can be pressed, the popup shows this text, which describes the same behaviour as above:

Detect automatically checks whether a sign-in cookie exists for the products you ticked. It never reads the contents of any cookie, and it never looks at products you did not tick.

6. Contact

Questions about this disclosure: [email protected]