Privacy Policy

1. Summary

WebMate AI helps users understand selected text and web pages, draft email replies, prepare entries for editable fields, and review browser actions before they are performed.

• WebMate AI does not operate a remote AI proxy or analytics backend.
• Local WebLLM processing runs on the user’s device. Page content and conversations are not sent to an AI provider in local mode.
• If a user expressly selects a cloud or command-line AI provider, the information required for that request is sent directly to that provider or through the user’s locally installed Native Messaging bridge.
• We do not sell personal information, use it for targeted advertising, or permit human review of page or communication content except with the user’s specific consent, as required by law, or when necessary to investigate a security incident.

2. Information the Extension handles

Depending on the feature used, the Extension may process the following information.

A. Page and browser context

• The active page title and URL.
• Text selected by the user and limited surrounding context.
• Visible headings and visible page body text, represented as Markdown or plain text.
• Labels, placeholders, ARIA attributes, current values, and options for editable fields.
• Labels and states of visible interactive controls needed to prepare a user-requested action plan.
• For Gmail, the visible subject, participants, message text, and the currently open reply editor.

The Extension does not intentionally collect browsing history. It examines the active page only as needed for a user-facing feature. A content script may remain available on ordinary HTTP and HTTPS pages so selection tools and page features continue to work as the user navigates, but a page snapshot is extracted only when the user invokes WebMate AI.

B. Information entered by the user

• Questions, instructions, notes, draft text, and other content entered into WebMate AI.
• Audio supplied for on-device transcription when voice input is used.
• User-approved field values and browser action instructions.

C. Settings and credentials

• Interface language, selected AI provider and model, consent status, and selection-helper preferences.
• API keys for OpenAI, Google Gemini, Anthropic, or a user-specified OpenAI-compatible service.
• A user-specified compatible API base URL.
• Temporary account-status information returned by Codex or Claude Code, such as whether the user is signed in and, where provided by that service, an account email or plan label.

D. Information deliberately excluded

WebMate AI is designed to exclude password fields, payment-card fields, verification or authentication codes, credential-like fields, and CAPTCHAs from AI prompts and automated actions. Users should not intentionally paste secrets or regulated information into WebMate AI prompts.

3. How information is used

The Extension uses the information described above only to:

1. answer a user’s question about selected text or the active page;
2. summarize, explain, translate, or rewrite content;
3. prepare an email reply requested by the user;
4. map user-provided notes to editable fields and rich-text editors;
5. generate and execute a user-reviewed browser action plan;
6. remember the user’s settings and selected provider;
7. establish a connection to a provider deliberately configured by the user; and
8. protect the Extension, users, and third parties from security misuse.

We do not use Extension data for advertising, cross-site tracking, credit decisions, employment decisions, insurance decisions, or other profiling that produces legal or similarly significant effects.

4. AI modes and disclosures to third parties

The user chooses the AI mode. WebMate AI does not silently fall back from local processing to a cloud provider.

A. Local WebLLM mode

Local models run in a Web Worker using WebGPU. Page content, email text, field data, prompts, and conversations remain on the device and are not sent to us or to an AI API.

On first use of a model, the Extension downloads model and runtime files from public distribution services operated by Hugging Face, MLC, or their content-delivery providers. Those services may receive ordinary network metadata such as the user’s IP address, user agent, request time, and requested model-file path. WebMate AI does not include page content or conversation content in model-download requests.

B. OpenAI API

If the user selects OpenAI API, the API key and request context needed for the chosen feature are sent directly from the Extension to OpenAI. Requests are configured with store: false where supported. OpenAI’s terms, privacy policy, retention practices, account controls, and billing rules apply.

C. Google Gemini API

If the user selects Gemini API, the API key and required request context are sent directly from the Extension to Google’s Gemini API. Google’s terms, privacy policy, retention practices, account controls, and billing rules apply.

D. Anthropic Claude API

If the user selects Anthropic API, the API key and required request context are sent directly from the Extension to Anthropic. Anthropic’s terms, privacy policy, retention practices, account controls, and billing rules apply.

E. OpenAI-compatible API

If the user configures an OpenAI-compatible API, the API key and required request context are sent to the base URL selected by the user. That endpoint is not operated or controlled by Cosinus unless we expressly identify it as a Cosinus service. The endpoint operator’s terms, privacy practices, security, and retention rules apply. Users should configure only endpoints they trust and should use HTTPS.

F. Codex and Claude Code through Native Messaging

If the user selects Codex or Claude Code, the Extension sends the request to the user’s locally installed Native Messaging bridge. The bridge then invokes the corresponding command-line tool on the same device. The command-line provider may transmit request content to its service under the user’s account and that provider’s terms and privacy policy. Cosinus does not receive the request through an Extension-operated proxy.

G. Provider responsibility

AI providers and user-selected endpoints are independent third parties. Cosinus does not control their availability, model outputs, security, logging, retention, training practices, billing, or legal terms. The user is responsible for reviewing the applicable provider terms before enabling a non-local mode.

5. Local storage and credentials

WebMate AI stores preferences, provider configuration, API keys, and Extension state in browser-managed extension storage on the user’s device. This information is not sent to Cosinus. A configured credential is disclosed only to the provider or endpoint the user deliberately selects for a request.

Browser extension storage is not a substitute for a dedicated password manager. Anyone with sufficient access to the user’s browser profile or device may be able to access locally stored Extension data. Users should secure their device, browser profile, and provider accounts, rotate credentials when appropriate, and remove credentials they no longer use.

6. Browser permissions

WebMate AI requests browser permissions only to provide its disclosed user-facing features.

Website access

Access to ordinary HTTP and HTTPS pages lets the Extension read user-selected or visible page context, detect editable fields and controls, provide selection tools, and perform actions the user has reviewed. Broad site access is needed because WebMate AI is designed to assist on websites chosen by the user. It is not used to build a browsing profile or collect content for advertising.

Storage

Storage access is used to keep settings, consent state, provider configuration, credentials, and local conversation or operational state needed for the Extension to work.

Tabs and scripting

Tab and scripting capabilities are used to identify the active page, obtain the context requested by the user, show Extension controls, and carry out a user-reviewed action on that page. WebMate AI does not use these capabilities to download or execute remote code.

Native Messaging

Native Messaging is used only when the user installs the local bridge and chooses a supported local command-line provider. It connects the Extension to that bridge on the same device.

Microphone or audio input

When voice input is available, audio is accessed only after the user invokes that feature and is used for on-device transcription. WebMate AI does not send that audio to Cosinus.

7. User review and control

WebMate AI is designed to keep the user in control of browser actions. Proposed email replies, field values, and multi-step browser action plans are presented for review before execution. The user can edit, reject, or cancel a proposal. Users remain responsible for verifying recipients, content, destinations, and consequences before approving an action.

Websites and browser interfaces can change without notice. Excluding sensitive fields and requiring user review reduce risk but cannot guarantee that every page is interpreted correctly or that every sensitive value is recognized. Users should not approve an action they do not understand.

8. Disclosure, sale, advertising, and human access

Cosinus does not receive page content, prompts, conversations, email text, form values, API keys, or browser action plans through an Extension-operated backend. When the user enables a non-local mode, the Extension discloses only the information needed for the requested feature to the provider or endpoint selected by the user.

We do not:

• sell or rent Extension user data;
• use or transfer Extension user data for personalized, retargeted, or interest-based advertising;
• transfer Extension user data to data brokers or information resellers;
• use Extension user data for creditworthiness, lending, employment, or insurance decisions; or
• use page content or personal communications to train a Cosinus AI model.

Cosinus personnel do not read page content or personal communications handled by the Extension unless the user expressly submits specific content for support and consents to that review, access is necessary to investigate abuse or a security incident, or disclosure is required by law. Provider personnel access is governed by the selected provider’s own terms and policies.

9. Chrome Web Store Limited Use compliance

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

WebMate AI uses information accessed through browser extension APIs only as necessary to provide or improve its disclosed user-facing functionality. Any transfer to a user-selected AI provider is limited to what is necessary to complete the request the user initiated. All other uses and transfers are prohibited except where required by law or necessary to protect against security threats, fraud, or abuse.

10. Data retention and deletion

Page context and action data

Page snapshots and action context are obtained when a user invokes a feature and are kept locally only as needed to complete the request, maintain the relevant local conversation or review state, and provide the feature. WebMate AI does not maintain a server-side browsing-history database.

Settings, conversations, and credentials

Locally stored settings, provider configuration, credentials, and conversation state remain in browser-managed extension storage until the user changes or clears them, clears the browser profile data, or uninstalls the Extension. Browser behavior may vary, including where synchronization or managed profiles are enabled.

Cloud and command-line providers

Information transmitted to an AI provider or user-selected endpoint is retained according to that provider’s terms, settings, and account controls. Requests to OpenAI are configured with store: false where supported, but provider-side abuse monitoring or other retention may still apply.

Support communications

If a user contacts Cosinus, we retain the contact details, message, and any content deliberately provided for as long as reasonably necessary to respond, maintain business records, investigate security or abuse, resolve disputes, and comply with legal obligations.

11. Security

WebMate AI minimizes data transfers by supporting on-device processing and direct connections to user-selected providers. Cloud API requests must use encrypted transport, and the Extension excludes common sensitive-field categories from prompts and automated actions. Cosinus also uses reasonable technical and organizational measures for information it actually receives, such as support messages.

No browser extension, device, model, endpoint, storage method, or internet transmission is completely secure. Users should keep Chrome, their operating system, the Extension, local bridge, and command-line tools updated; protect their device and browser profile; use trusted endpoints; and promptly revoke a credential they believe may have been exposed.

12. Children’s privacy

WebMate AI is a general-purpose productivity tool and is not directed to children under 13 or the higher minimum age required in a user’s jurisdiction. Cosinus does not knowingly collect children’s personal information through the Extension. If you believe a child has directly provided personal information to Cosinus, please contact us so we can review the request.

13. Your privacy choices and rights

Users can:

• choose local processing rather than a cloud or command-line provider;
• change or remove a configured provider, API key, base URL, or preference;
• clear locally stored conversations and Extension data using available Extension or browser controls;
• revoke site, microphone, or other permissions in Chrome where supported; or
• uninstall WebMate AI at any time.

Depending on where a user lives, the user may have rights concerning personal information held by Cosinus, including access, correction, deletion, restriction, objection, or portability rights. Because WebMate AI does not send Extension content to a Cosinus backend, we generally cannot identify or retrieve locally stored Extension content or content sent directly to a third-party provider. Requests concerning provider-held data should also be directed to that provider.

For information deliberately provided to Cosinus, submit a request through the contact method below. We may need to verify the requester’s identity or authority as permitted by applicable law.

14. International use

Cosinus is based in Japan. Local Extension data is not transferred to Cosinus. If a user contacts us, that communication may be processed in Japan and in other locations used by our service providers, subject to applicable law and safeguards. A user-selected AI provider may process data in additional countries under its own terms and privacy policy.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to WebMate AI, legal requirements, security practices, or operations. We will update the dates at the top of this page and, when appropriate, provide additional notice through the Extension, its store listing, or the Cosinus website. We will update this policy and required store disclosures before materially expanding the Extension’s data practices.

16. Contact us

For privacy questions or requests concerning WebMate AI, use the Cosinus contact form and include “WebMate AI privacy” in your message, or write to: