Matrx Extend — Chrome Extension Privacy Policy

Overview

Matrx Extend (the “extension”) is an opt-in AI assistant published by AI Matrx. It runs in your browser’s side panel and helps you understand and act on the web page you are currently viewing — reading only the pages you explicitly choose to use it on.

You can use the extension either with a Matrx account or as a guest, without creating an account. Guest use is described in its own section below.

This policy describes only the extension’s data practices. The broader AI Matrx website and platform are covered by the main AI Matrx Privacy Policy, which this document supplements.

Single purpose

The single purpose of Matrx Extend is to be an AI assistant that helps you understand and act on the web page you are currently viewing, from the browser side panel.

Everything the extension does serves that one purpose: answering questions about the current page, pulling information out of it, and — only when you ask — performing actions on it such as filling a form or navigating. It processes page content only for a feature you invoke or an automatic capture you explicitly enable. The default permission mode asks before actions that change a page; privileged actions always require confirmation.

What the extension accesses

On a fresh install, the extension accesses page content only when you take a deliberate action in the side panel, popup, or context menu. You may separately enable automatic page capture in Settings; that setting is off by default and can be turned off at any time.

• Account information. Your Matrx user identity (email and the OAuth tokens issued by Supabase) is stored locally in chrome.storage, with the refresh token AES-GCM-encrypted at rest. These tokens are used to authenticate requests to your own Matrx account and are not shared with any third party.
• Page content you choose to capture.When you click an action such as “Scrape this page”, “Run SEO audit”, or “Extract data”, the extension reads the current tab’s DOM (text, images, links, structured data) and processes a cleaned representation locally or sends it to the Matrx service when the feature requires server processing or saving. We do not capture pages you have not acted on unless you explicitly enable automatic capture in Settings.
• Chat input you provide. Messages you type into the Chat tab, plus any context you explicitly attach (for example, the current page title and URL), are sent to your Matrx backend so your selected agent can respond. Conversation history is stored under your account.
• Saved extraction patterns. Patterns you define in the Data tab — selectors, field names, the URL or domain they apply to — are saved to your Matrx account so they can be reapplied on future visits.
• Website logins you choose to save (Vault).When you are signed in to Matrx, the side panel has a Vault tab for website usernames and passwords you save to your own Matrx account. A login can enter the Vault in three ways, each requiring your deliberate action: you type it into the Vault tab; after you sign in to a website yourself, the extension shows a small “Save this login?” prompt (on the page and in the Vault tab) and saves only if you click Save or Update; or, when an AI agent you are directing reaches a login it has no saved credential for, it shows you a box in the side panel to type the login yourself. In every case the username and password travel over HTTPS only to your Matrx account’s Vault, are encrypted at rest on our servers, and are never sent to an AI model provider or shown to the assistant. A saved login is filled into a page only for the website it was saved for, and only when you click “Use here” or approve an agent action that asks for it. The save prompt displays only the site and the username you entered; it holds the password briefly in extension memory (never on disk) and discards it if you dismiss the prompt or do nothing for a few minutes. You can turn the prompt off in Settings → Privacy, silence it for individual sites, and view, edit, or delete any saved login at any time.
• Local preferences. Settings such as your preferred backend environment, UI state, pairing tokens for an optional local desktop companion app, and the list of sites you asked the save-login prompt not to ask about again (site addresses only) are stored in chrome.storage on your machine.

What the extension does NOT do

• We do not train AI models on your data.Content captured through the extension is stored in your account so you can use it. It is not used to train, fine-tune, or improve any model — ours or anyone else’s.
• We do not sell or rent your data to data brokers, advertisers, or any third party.
• We do not use your data for advertising, including personalized advertising, profiling, or creditworthiness determinations.
• Automatic capture is opt-in. It is off on a fresh install. If you enable it in Settings, the extension captures the active page after navigation so it is ready for your next chat request. The extension does not silently crawl unrelated tabs, and it does not send browsing telemetry.
• We do not let humans browse your captured content except (a) with your affirmative consent, (b) as required for security or fraud investigation, or (c) to comply with applicable law.

These commitments mirror Google’s Chrome Web Store Limited Use requirements and apply to all data the extension handles.

Where your data goes

• Supabase (operated by AI Matrx) — for authentication and direct, row-level-secured reads/writes of your saved captures, patterns, conversations, and audits.
• Matrx backend at server.app.matrxserver.com — for agent execution, streaming responses, server-side processing, and your Vault of saved website logins (stored encrypted at rest under your account; never forwarded to an AI model provider).
• AI model providers. To generate a response, the Matrx backend forwards your message and any page context you included to the AI model provider that the agent you are using is configured to run on (for example Anthropic, OpenAI, or Google). This means the content of a page you engage the assistant on can be sent to that provider. Providers are used to generate your response; we do not authorize them to use your content to train their models.

No other third parties receive your content. If you have paired the optional Matrx desktop companion app, the extension may communicate with it locally on your machine; that traffic does not leave your device.

Why each Chrome permission is requested

• Host access (<all_urls>). Required because users decide which pages to scrape, audit, or extract structured data from — the extension cannot know in advance which sites a user will work with. A lightweight content-script bridge is present on normal web pages so the side panel can respond immediately; it does not transmit page content until the user invokes a feature or has explicitly enabled automatic capture.
• activeTab + scripting. Used to inject the scrape collectors and the structured-data picker into the current tab when the user triggers them.
• tabs + tabGroups. Lets the assistant identify the active page and, when requested, open, switch, close, or group browser tabs.
• storage. Persists your session tokens, preferences, and cached extraction patterns locally in chrome.storage.
• sidePanel.Renders the extension’s primary UI as a Chrome side panel.
• identity. Powers the OAuth sign-in flow via chrome.identity.launchWebAuthFlow against the Matrx Supabase auth endpoint.
• offscreen. Holds long-running fetch/SSE streams (agent responses, scrape pipelines) so they are not cut off when Chrome suspends the service worker.
• nativeMessaging. Optional. When the user has installed the Matrx desktop companion app, the extension uses native messaging to talk to it locally for advanced file-system-aware workflows. The extension functions fully without it.
• alarms. Schedules a token refresh ahead of expiry and runs user-scheduled tasks at the requested time.
• contextMenus. Adds right-click actions for sending the current page or selected text into the extension.
• clipboardWrite. Lets the user copy extracted content (Markdown, JSON, etc.) to the clipboard.
• downloads.Saves user-initiated exports of captured data to the user’s local file system.
• webNavigation. Detects tab navigation events so the extension can recognize when the user has returned to a page that already has a saved extraction pattern.
• history + bookmarks + sessions. Lets the assistant search browser history, read bookmarks, and restore a recently closed tab only when the user requests those actions.
• notifications. Alerts the user when a task they started completes or needs attention.
• debugger. Supports advanced browser functions Chrome does not expose through narrower APIs, including full-page capture, PDF export, workflow recording, page-network inspection, accessibility inspection, difficult page interaction, and viewport emulation. It is not used to execute code. Chrome displays its debugging banner whenever this access is active.
• Optional permissions. Cookies, page capture, clipboard read, and tab capture are off until the user grants them at runtime for the matching advanced feature. They can be revoked from the extension Settings or Chrome settings.

Guest access (using the extension without an account)

You can open the side panel and use the assistant immediately, as a guest, without signing up. Guest use works the same way as signed-in use, and this policy applies to it in full.

To make that work, when you use the extension as a guest:

• We create an anonymous account for you. Your installation generates a random identifier (it is not derived from your name, email, IP address, device hardware, or any other personal information). We send that identifier with your requests and use it to create and recognize an anonymous account on our servers, so your conversation can be processed and so we can apply fair-use limits.
• Your guest activity is stored under that anonymous account — the same conversations and content described elsewhere in this policy, handled the same way. It is not linked to a real-world identity, because we do not have one for you.
• If you later create an account or sign in, your guest activity is carried over and becomes part of that account.
• You can clear it. Uninstalling the extension, or clearing its local storage, discards the identifier on your device. To delete the anonymous account data held on our servers, email support@aimatrx.com. Because guest accounts are anonymous, please send the request from the extension while the identifier is still installed, or include it, so we can find the right records.

Your controls

• Use it as a guest — you are not required to create an account to use the assistant.
• Sign out from the Settings tab clears local tokens immediately.
• Uninstall the extension to remove all extension-local storage.
• Delete saved data (captures, patterns, conversations, SEO audits) at any time from your Matrx account, or by emailing us.
• Saved website loginscan be viewed, changed, or deleted at any time from the Vault tab or your Matrx account. The “Save this login?” prompt can be turned off in Settings → Privacy, or silenced for individual sites.
• Account deletion requests — for a full account or for an anonymous guest account — can be sent to support@aimatrx.com.

Children

Matrx Extend is not directed to children under 13 and we do not knowingly collect data from them.

Changes

We will update the “Last updated” date and the body of this page if our extension data practices change. Material changes will also be surfaced in the extension itself.

Contact

Questions about this policy or a request related to your data: support@aimatrx.com or via our contact form.