Privacy policy

AI Tools Notify and Progress Bar: Agents Tray Watcher (Chrome extension).

Effective date: 11 September 2026. Contact: [email protected] (the repository issue tracker is the alternative channel).

This is the document the Chrome Web Store listing links to. It is written to be read, not to be survived.

The short version

Everything stays on your machine. There is no account, no server of ours, and no analytics. A fresh install makes no network request at all. Every request the extension can ever make is listed inside the extension itself, in Settings under Data and privacy, next to a switch that blocks all of them.

Nothing is sold. Nothing is shared with the developer. There is no third party in this document at all except the services you yourself configure.

1. What the extension reads

1.1 Pages, only on sites you enabled

The extension ships with no host list in its manifest and no static content script, so on a fresh install it reads no page. A site is only read after you switch on a tool for that site and Chrome asks you about that one origin. Turning the tool off revokes the origin and removes the script.

On an enabled page the extension looks at:

• semantic progress elements: <progress>, role="progressbar", and the aria-valuenow, aria-valuemax and aria-valuetext attributes;
• short runs of text that match progress patterns, for example "42%", "step 3 of 5", "position #7", "generating", "failed";
• the geometry of elements that look like a progress bar, that is an inline percentage width or a scaleX transform;
• whether a video, an audio element or a download link appeared inside a container that was generating, and whether a spinner disappeared.

It deliberately does not read form fields, textareas, elements marked contenteditable, script bodies, or the content of chat messages. That exclusion is in the code, not a policy promise.

What the page produces is a task record: a tool name, a short title (usually the status line or the tab title), a state, a percentage when one exists, and the tab address so the panel can bring you back to it. That record stays in the browser.

1.2 Tab titles

On enabled origins the extension watches the tab title for words such as "generating" or for a percentage, which is a cheap way to notice that something started or ended. Titles are matched in memory. They are not stored and not sent anywhere.

1.3 Hook payloads from terminal agents

Terminal agents such as Claude Code, Codex CLI and Gemini CLI cannot talk to a browser extension directly. If you set them up, they post their own hook events to a small relay that you run on your own machine (relay/server.js in the repository, bound to 127.0.0.1), and the extension opens a WebSocket to that relay.

The payload the extension reads out of a hook event is: the tool id, the hook name, a machine label you chose, the working directory, a session id, and the message the agent produced (for example "Claude needs your permission to run git push"). That message becomes the task title you see in the panel. The relay keeps events in memory only, writes nothing to disk, and talks to no third party.

The relay is off until you configure it. Websites never need it.

1.4 Network interception, off by default, disclosed explicitly

This deserves its own heading rather than a footnote.

If you switch on network interception for a specific site, a script runs in that page and wraps fetch, XMLHttpRequest, WebSocket and EventSource. For responses whose address matches that site's job endpoint, it parses the JSON, copies out only the progress fields (progress, status, queue position, estimated seconds, job id, result address) and discards the body immediately. Nothing is buffered, stored or transmitted. Binary frames, streams and non JSON responses are skipped entirely.

The feature is off globally and off per site until you turn it on for that site, and the script that performs the wrapping is injected only into origins where it is on. It is separate from ordinary tracking precisely so that granting a site does not silently grant this.

1.5 WebMCP, off by default

If you switch on the WebMCP adapter, the extension registers a reportProgress tool on enabled pages so a browser agent can report its own progress, and it wraps navigator.modelContext.registerTool to notice when a tool the site published was called. It records the tool name and the fact that it started and finished. Arguments and return values are not read.

2. What is stored, where, and for how long

All of it lives in your own browser profile, in chrome.storage.local and chrome.storage.session. chrome.storage.sync is deliberately never used, so nothing is copied to another device or to a Google account.

"Erase everything" in Settings, Data and privacy removes all of it and revokes every site permission the extension holds.

Uninstalling the extension makes Chrome delete its storage.

3. What leaves your machine, and only when you have configured it

A fresh install makes zero network requests. These three are the only outbound paths that exist in the code, and each one is off until you switch it on.

1. Your relay. The extension opens a WebSocket to the address you configured, by default ws://127.0.0.1:8787, and receives task events from your own terminal agents. The relay in this repository binds to localhost, keeps the last events in memory, writes nothing to disk and talks to no third party. If you point the setting at a remote server of your own instead, the traffic goes there and nowhere else.
2. Messenger channels. If you add a Telegram, Slack, Discord, ntfy or webhook channel, the extension posts your notification text to that service when a task matches your filter. The text is the template you configured, by default the tool, the state, the task title, the duration and the task address. Credentials go only to the service they belong to. That service's own privacy policy then applies to what you sent it.
3. Site rule updates. Off by default. If you turn it on, the extension downloads a JSON file of site selectors once a day. It is data, it is never executed as code, and it carries no identifier of you.

There is nothing else. No telemetry endpoint, no crash reporter, no error collector, no feature flag service, no fonts or scripts from a content delivery network, no advertising or attribution SDK.

Nothing is ever sent to the developer. There is no address in the code that belongs to us.

4. What is never done

• Your data is not sold, and will not be sold later. This is a commitment in the policy, not only a fact about the current code.
• Your data is not used for analytics, not even anonymised or aggregated counters, and not for any purpose unrelated to showing you the progress of your own tasks.
• Your data is not used or transferred to determine creditworthiness or for lending purposes.
• No remote code is loaded or executed.
• No account is required and the developer does not know who you are.
• No new permission arrives in a patch release. A new permission means a new major version with a changelog entry that says what it is for.

5. Verifying this instead of believing it

• Open Settings, Data and privacy. The outbound log lists every request the extension has made, with its destination and its result.
• Flip the kill switch. Every outbound request stops, while detection in the page keeps working, because it never needed the network.
• Open the Network tab of DevTools on a fresh profile and watch the extension make nothing happen.
• The source is public and each store release is a repository tag. The build script writes a deterministic zip and prints its SHA-256, so the package in the store can be rebuilt from the tag and compared.

6. Children

The extension is not directed at children and collects nothing from anyone, including them.

7. Changes to this policy

A material change ships with the version that introduces it and is listed in the changelog. The effective date at the top always matches the shipped copy. The hosted copy and the copy in the repository are the same file.

8. Contact

Write to [email protected], or open an issue in the public repository if you would rather ask in the open.