Privacy Policy

Effective date: August 27, 2026 · Applies to the browsa browser extension and this website

The one-line version: browsa collects nothing. No accounts, no analytics, no servers of ours. Your conversations, settings, and API keys live only inside your own browser.

What we collect

Nothing. browsa contains no telemetry, analytics, or tracking code of any kind. No usage data, page content, or personal information is ever sent to the developer or to any third-party service on our side. You can audit this claim — the source is public under the MIT license at github.com/xiaohuzai/browsa.

Where data lives

Chat history, saved sessions, provider configs, and API keys are stored exclusively in your browser's local storage (chrome.storage.local) on your device.
Uninstalling the extension removes everything; clearing browser data removes it too.
browsa performs no cloud sync of any kind.

Where network requests go

browsa only makes network requests when you act, and only to destinations you configure yourself:

AI chat: requests are sent by your browser directly to the provider address you entered in Settings (OpenAI, Anthropic, any OpenAI-compatible API, or local Ollama). They never pass through an intermediary server. Page content attached to a conversation passes through a local preprocessing step: sensitive URL parameters such as passwords, tokens, and signatures are masked before anything is sent — entirely inside your browser.
Speech transcription (optional): only if you enable ASR and enter your own Volcengine Ark key — audio is transcoded locally, then uploaded by your browser straight to that service. If disabled, nothing runs.
Site extraction: reads data the page itself already loaded (subtitles, article bodies) — no re-authentication, no uploading to third parties.
Media downloads: connections open on demand, only when you click download.

Permission usage

<all_urls> / tabs / scripting: to read readable content from the page when you click 📎, inject read-only extraction scripts, and seek videos when you click a timestamp. Runs only on your action.
cookies: read-only, used solely to carry your login context when downloading a media stream from that platform.
declarativeNetRequest: temporary session-scoped rules that add a Referer header for explicitly requested media downloads; rules clear with the browser session.
downloads: saves media you explicitly chose to download.
storage: the local data described above.

Subprocessors and third parties

browsa has no backend and therefore no subprocessors. You remain responsible for the privacy terms of the AI providers you configure; with local models such as Ollama, conversations never leave your device at all.

Children

browsa collects no information from anyone of any age — there is no data to concern minors.

Changes & contact

Material changes will be posted on this page with an updated effective date. Questions? Open an issue at github.com/xiaohuzai/browsa/issues.