Privacy Policy for CocoViral Browser Agent

1. In short

• The extension works only in tabs it opened itself, grouped in a pink "CocoViral Agent" tab group, and only on sites you allowed.
• It reads a page only when your agent asks it to as part of a task you gave it, and every click, typing step and key press is shown to you first and carried out only after you allow it.
• What it reads goes to your own CocoViral agent session, so the agent can decide the next step. It is not sold, not used for advertising and not shared except with the service providers listed below.
• Recognized sensitive fields are excluded from structured field values and refused for clicking or typing. Page text and screenshots are not automatically redacted and may include sensitive information. The extension does not use cookie, history, saved-password or autofill APIs.

2. What the extension can access

Chrome lets an extension like this one reach any website, because you decide which sites your agent works on (for example TikTok, YouTube Studio or Instagram) and those cannot be listed in advance. The extension limits itself as follows:

• Sites: the first time the agent needs a site, a card in your chat asks whether it may work there: "Allow for this chat", "Always allow" or "Not now". It does nothing on a site you have not allowed. A site allowed for one chat is remembered for that chat until Chrome closes; a site you always allow is remembered until you remove it from the extension's menu (its toolbar icon).
• Tabs: it reads and acts only in tabs it opened for the agent. It queries tab metadata to group its tabs and restore the previously active tab after screenshots; it may briefly focus the browser window to capture an agent tab. It does not read page content from unrelated tabs. Moving a tab into the agent group does not grant access.
• Sensitive fields: password fields, one-time-code fields, payment-card and bank fields, and file-upload fields are marked as sensitive. The extension excludes recognized sensitive field values from its structured field list and refuses to type into or click recognized sensitive fields; you fill those in yourself. Detection is heuristic, not a guarantee. Sensitive information visible elsewhere in page text or screenshots can still be transmitted.
• Browser data: it does not use the cookies, history, bookmarks, downloads, saved-password or autofill APIs. Task results do include agent-tab URLs and titles and records of requested browser actions.

3. What it sends to CocoViral, and when

The extension sends something only in answer to a browser step of a task you started in the agent. For each step it returns the result to the CocoViral agent page open in the same Chrome (on cocoviral.ai or www.cocoviral.ai), and that page sends it to our servers over HTTPS. The extension itself makes no other network requests. Depending on the step, the result contains:

• The address (URL) and title of the agent's tab.
• The visible text of that page, up to 20,000 characters.
• A list of up to 250 buttons, links and form fields on the page with their labels, link addresses, and the text already in ordinary (non-sensitive) fields, so the agent can choose what to click or type into.
• A screenshot of the agent's tab, only when the agent asks for one as a step. It is shown to you as a thumbnail in the chat.
• The list of the agent's own tabs (address and title), and whether a step succeeded or why it failed.

The page you are on may show personal information, such as your account name or messages on that page. Visible content can also include financial, health, authentication or location information. Page text and screenshots are not automatically redacted. Anything included in these results is sent to the service providers below. Do not request access to pages containing information you do not want processed; close sensitive content before requesting a screenshot.

4. How we use it

We use what the extension returns only to carry out the task you gave the agent and to show you the history of that chat:

• The step's result is saved in your agent session, so the agent can continue the task and you can see what it did.
• It is given to the AI model that runs your agent, so the model can decide the next step. Page text is labelled to the model as untrusted web content, never as instructions.
• A screenshot is saved to your chat's board as an image, like other images the agent makes, and an AI vision model describes it in words so the agent can understand the page.

We do not sell this data, use it for advertising, use it to decide creditworthiness or for lending, or use it for any purpose unrelated to the browser steps you ask for.

5. Who else receives it

We share it only with the service providers that run CocoViral for us, and only so they can do so:

• AI model providers: the model you chose for your agent (for example from DeepSeek, Anthropic, OpenAI, Google or Moonshot) receives the step result through OttoPort, our model gateway, to work out the next step; a screenshot is also sent through OttoPort to a vision model, which describes it.
• Supabase, which hosts the database where your agent sessions are stored.
• Cloudflare, which stores screenshots (in R2 storage).

We may also disclose data when the law requires it, to protect the safety and security of our users and service, or as part of a merger or sale of the business, as described in the CocoViral Privacy Policy.

6. What stays in your browser

The extension keeps a few things in Chrome's own extension storage, on your computer only:

• The sites you always allow, until you remove a site from the extension's menu or uninstall the extension.
• The sites you allowed for one chat (listed by the chat's internal ID), the sites the agent has just asked about, which tabs and tab group belong to the agent, and a short diagnostics record (the extension version, the last step and the last error) shown in its menu. These are cleared when Chrome closes.

None of this is sent to us, except when you choose to copy the diagnostics from the extension's menu and send them to support yourself.

7. How long we keep it

Step results and screenshots are stored with your agent session. Removing a chat from your chat list or deleting an account does not by itself guarantee deletion of separately stored screenshots. Contact support to request deletion of stored browser results and screenshots; we do not promise a fixed automatic deletion period. Data may be retained where required for legal or security purposes. To have a specific chat's browser data deleted sooner, email us from the address on your account. Screenshots are stored at a long, unguessable address; anyone who has that exact address can open the image, so share it with care.

8. Your controls

• Decline any step on its card in the chat; the agent is told you declined and does not retry it.
• Allow each site for one chat or always, or refuse it, the first time; remove allowed sites from the extension's menu.
• Close the "CocoViral Agent" tab group or any agent tab at any time; the agent stops working there.
• Turn the extension off or remove it in chrome://extensions. Removing it deletes everything it kept in your browser.
• Access, export or delete your account data as described in the CocoViral Privacy Policy.

9. Security

The Chrome Web Store package accepts commands only from the CocoViral agent page on cocoviral.ai or www.cocoviral.ai. Developer builds may also allow localhost and 127.0.0.1. A site can be allowed only from that page, and only within 10 minutes after the agent asked about that very site, so no other website can give itself access. All of the extension's code ships inside its package; it does not download or run code from anywhere else. Results travel to us over HTTPS.

10. Children

CocoViral is for people 18 and older. We do not knowingly collect data from children.

11. Changes

If the extension starts to read, send or keep anything this policy does not describe, we will update this page and its effective date first, and ask for your agreement where the law or the Chrome Web Store requires it.

12. Contact

Privacy questions and requests: [email protected].