OpenTool — Privacy Policy

Last updated: 30 August 2026

OpenTool has no server, no analytics, and no telemetry. Everything it stores lives in chrome.storage.local on your machine: settings, conversations, per-provider API keys, per-site permission grants, custom providers, and shortcuts. Nothing is synced anywhere by the extension.

What leaves your machine, and when

• Chat and agent messages (including page text, accessibility trees, console/network reads, and screenshots the agent takes) are sent to the one LLM provider you selected, using the API key you configured.
• API keys are sent only to their own provider as request auth headers.
• A one-off capability check may send a small generated test image — a 48×16 PNG of three colour bands, containing nothing of yours — to the provider you selected, on the first message to a model whose published data does not say whether it can read images. It runs once per model, ever, and its only purpose is to stop a text-only model being handed a screenshot it cannot see and inventing an answer about it.
• OpenRouter's public model catalogue is fetched from openrouter.ai/api/v1/models to cross-reference what a model accepts, and this happens whichever provider you chose — many providers publish no capability data of their own, and reading a public list is how the check stays free and avoids sending a test image at all. The request carries no API key, no headers, no page content and nothing else about you; it is the same anonymous list anyone can open in a browser. OpenRouter still sees the IP address the request comes from, so if you would rather it did not, this is the one call to know about.

The provider you choose is a third party with its own privacy policy, and page content the agent reads is included in what it receives. Which provider that is is entirely your choice. Apart from the anonymous catalogue read described above, the extension talks to no one but that provider.

Nothing is sent anywhere until you send a message or start an agent run.

Saving a page as Markdown

The Save page as Markdown button converts the page you are looking at into a Markdown file. The conversion happens entirely on your machine — no model is involved and nothing is uploaded. The file is yours, and it stays in the conversation until you delete it.

The converter reads the rendered page, so it can see anything you can see — with two deliberate exceptions, because a Markdown file is something you might share:

• Nothing you have typed into the page. The values of <input> fields are never read (a hidden one is usually a CSRF token, not content), and neither is the contents of a <textarea> — an unsent reply you are part way through writing is yours, not the page's.
• Credential-shaped query parameters in any link — token, key, secret, session, signature and the like — are replaced with REDACTED.

Content that is hidden (display:none, visibility:hidden) is left out, and the file says how much was skipped.

If the agent runs the same export as part of a task, the file still goes to you — the model is sent only a short receipt saying the file was produced, not its contents.

Task recordings

You can record yourself performing a task so the agent can learn the flow and repeat it. Recording only ever starts when you press record, only on the tab you choose, and a red REC badge stays on the toolbar icon until you stop.

A recording is stored in IndexedDB on your machine and holds:

• the actions you took (clicks, scrolls, drags, navigation) with the element each one targeted, described by its role, accessible name, and selector
• your cursor path, and low-resolution screenshots of the tab (about one per second, only while you are acting)

What a recording never contains: the text you type. Typed values are never captured — only the fact that a field was filled. Ordinary keystrokes are not recorded either; only command keys (Enter, Tab, Escape, arrows) and shortcut combinations such as Ctrl+C. On password, payment, one-time-code, and similar fields the element's own text is redacted as well, and the action is marked as touching a sensitive field.

OpenTool never accesses your microphone or camera. The recorder captures no audio of any kind.

Recordings stay on your machine until you ask the agent to read one. At that point its contents — including the screenshots — are sent to the LLM provider you configured, exactly like any other page the agent reads.

Permissions, and why

Safety rails

Page-mutating agent actions are permission-gated (typed per-site grants, plan approval, always-confirm on banking/payment sites), and the agent never acts on a page whose origin changed since the model last read it.