Legal

Omnesis Browser Extension Privacy Policy

Last updated: 2026-10-28

Summary

Omnesis reads supported HTTPS pages only after you explicitly grant Chrome page access. It extracts readable text and visit metadata and sends them directly to the HTTPS Omnesis gateway you pair with the extension. Ordinarily that gateway runs on hardware you control. If you deliberately select a developer-operated gateway, the developer receives the data as that gateway's operator. The extension contains no analytics, advertising, or crash-reporting SDK.

What the extension accesses

• Readable page content — the page title and readable text converted to Markdown. Raw HTML, scripts, images, and page pixels are not sent. Form controls and editable regions are removed before extraction. Readable page text, titles, and URLs can still contain sensitive information, so review the disclosure and exclusions before enabling capture.
• Visit metadata — the normalized page URL, domain, title, visit time, and focused dwell duration.
• Pairing information — the gateway HTTPS URL, one-time pairing code, a browser device identifier, the Chrome profile name you enter during pairing, and a bearer token limited to writing the browser-capture source. Chrome does not expose its local profile name to extensions; the entered label and stable device identifier are attached to each visit. A page document is one snapshot per URL, so its metadata records the profile whose capture most recently changed that snapshot. The code is sent to the selected gateway for redemption. If that request times out, the same code is sent again with the same request identifier so the gateway can return the credential it already issued; the extension keeps only a hash of the code and that identifier, for at most fifteen minutes, and never the code itself. The extension's own version number is sent when pairing and with each upload and periodic check, so the gateway can show which build each paired browser runs; it identifies the extension build, not you.
• Experimental features — page notes and Find are hidden unless the paired gateway runs with OMNESIS_EXPERIMENTAL=1. Existing credentials cannot bypass that gate. Compatible experimental gateways automatically enable these features for an already paired browser without separate portal approval. Automatic page capture remains available by default.
• Tell Omnesis notes — the text you submit, the page title and URL, an optional selected quotation, the capture time and timezone, and the paired browser identity. Drafts stay in the extension until you submit them. Creating notes uses a separate notes:create credential. Tell Omnesis also lists saved notes associated with the page using its read credential and allows explicit text edits with a separate notes:update credential. Edits retain the original page context and quotation; revision checks prevent silently overwriting concurrent edits.
• Find — queries sent to the paired gateway and returned document titles, snippets and source links. A separate device-bound read credential permits ordinary search across indexed sources. The extension filters results for browser-openable source links. The current query, results and bounded agent explanation stay in local extension storage so the panel can reopen them. When a decision model is enabled, it can choose a read-only agent search that inspects indexed evidence and returns browser destinations. The panel shows the decision, streamed explanation and transient tool activity. Each query starts a fresh task, with no follow-up conversation. Open-tab URLs are compared locally and the tab list is not uploaded.
• Address-bar suggestions — after you enter om followed by Space or Tab, query edits are sent to your paired experimental gateway to retrieve index suggestions. Preview results remain in memory for that input session. Typing suggestions does not invoke the decision model or agent. Submitting the query itself opens Find and uses its configured search behavior. Text outside Omnesis keyword mode is not forwarded.
• Local controls and delivery state — Chrome profile label, the paired gateway's reported version, recent status, a bounded retry queue, and a copy of the capture settings the paired gateway holds (pause, excluded domains, pages you deleted for good).

The extension does not run in incognito windows. Chrome-internal pages, pages on the domains you exclude, pages you deleted for good, sign-in, registration, checkout and payment pages, and pages carrying a password field are not captured. These capture settings are stored on your paired gateway and apply to every browser paired with it. Domains a dedicated Omnesis source already covers are also skipped, so a page is not collected twice. These restrictions apply to automatic page capture. Tell Omnesis sends only the note and quotation you explicitly submit, with their page context, even when automatic capture is paused or the page is excluded.

Because a signed-in page can contain identifying details, communications, financial or health information, authentication-related text, or location information, readable text from those categories may be included when you allow capture on that page. Omnesis does not target or infer these categories in the extension. Exclude sensitive domains, pause capture, or remove page access whenever you do not want a page captured.

Where data goes

Captured content, visit metadata, submitted notes and search queries are sent over HTTPS directly to the gateway you approve during pairing. Pair only with an endpoint and operator you trust. The extension developer does not receive this data merely because you installed the extension. The developer does receive it if you deliberately pair with a developer-operated gateway.

If the gateway operator enables a cloud model for indexing, decision or agent features, the gateway may send the inputs needed for that configured role to the selected model provider. The extension does not choose or contact that provider; the gateway operator controls that processing and the provider's terms apply.

Chrome permissions

• Optional HTTPS page access lets the extension read rendered pages. It is requested during pairing, not at installation, and removed when unpairing.
• Storage retains pairing, a copy of the gateway's capture settings, bounded queued captures, and status in the extension profile.
• Unlimited storage lets the bounded retry queue and staged page handoffs survive a temporary gateway outage when their combined content exceeds Chrome's normal local-storage quota. The extension still applies fixed byte and item limits.
• Alarms lets the Manifest V3 worker retry queued delivery and refresh health while Chrome is running.
• Scripting lets the extension register the capture script after page access is granted. The popup uses that same optional page grant to report capture status.
• Active tab gives temporary access to the page URL, title and selected text when you explicitly invoke Tell Omnesis.
• Context menus adds Tell Omnesis to the page and selection right-click menus when the feature is enabled.
• Side panel displays the note composer alongside the page.
• Tabs lets Find indicate source links already open across the Chrome profile. Matching stays local and the tab list is not uploaded. Chrome requests this permission at installation or upgrade. Browser-history access is not requested.
• Favicon displays site icons through Chrome's local favicon service. Chrome grants this permission at installation or upgrade. Missing icons use a fallback; the extension sends no result URLs to a third-party icon service.
• Search lets the address bar hand text you submit after the om keyword to Chrome's default search engine when the paired gateway does not offer Find, as the address bar says before you press Enter, instead of discarding it. A query typed while Find is available is never sent there.

Retention and control

Successfully delivered queue entries are removed from local extension storage. Pending entries — which hold the captured page text itself — survive browser and worker restarts so temporary outages do not lose data, but the queue has fixed item and byte limits and evicts old entries when those limits are reached. Credential-bearing query parameters (tokens, signatures, one-time codes, passwords, session ids) are removed from a page's address before it is recorded, so a password-reset link or a signed download link is stored without its secret. Pairing, notes and Find credentials remain until you unpair or clear the extension's data. Notes drafts and submitted notes waiting for delivery are stored locally; delivered notes are removed from the local delivery queue. A full notes queue refuses new submissions instead of evicting previously submitted notes.

Find keeps the current results and bounded agent explanation locally when the Find page closes or the gateway is temporarily unavailable. When the gateway reports that Find permission is revoked, the extension removes that cached result content.

• Pause capture from the extension popup; the pause applies to every browser paired with the same gateway.
• Exclude any domain from the options page or the popup. The exclusion is stored on your gateway and applies to every browser paired with it; you can also delete the pages the domain already contributed.
• Unpair to remove gateway credentials, Find query and result state, note drafts and queued notes, pending captures, recent delivery state, the copy of the capture settings, and the extension's HTTPS page-access grant. The Chrome profile label and random installation identifier remain so your browser identity survives a later re-pair; removing the extension or clearing its data removes them. Excluded domains stay on the gateway.
• Remove the extension or clear its data to remove its remaining local storage.
• Delete data already delivered using the controls provided by the paired gateway.

Data practices

We do not sell, rent, or use extension data for advertising, credit, lending, profiling, or unrelated purposes. We do not transfer extension data to data brokers. Data is handled only to provide pairing, browser capture, delivery, status, and the controls described above. The extension's use and transfer of data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

The developer does not permit humans to read extension user data. Any exceptional access is limited to cases allowed by the Limited Use requirements: your affirmative consent for specific data, security or abuse investigation, legal compliance, or internal processing of aggregated and anonymized data. For gateways not operated by the developer, the extension does not provide the developer with a channel into your paired gateway.

Changes and contact

Material changes will be reflected here and the last-updated date will change. Questions and security reports can be sent to contact@omnesis.dev.