brw← Back to brw

privacy

Privacy policy

Last updated: 10 September 2026

This policy covers the brw Chrome extension and the brw daemon (brwd). The short version: brw handles browser data only to perform browser control you request. The extension sends it to a brw daemon on localhost. Don Works and Revitt do not receive, collect, sell or use that data, and brw contains no advertising or publisher analytics.

Browser data brw handles

When you enable the bridge and ask an agent to use the browser, brw may handle the minimum information needed for that task, including:

  • open-tab URLs and titles, navigation state and the tab or tab group being controlled;
  • visible website content, headings, links, forms, tables, semantic controls and values an agent needs to read or change;
  • console and network diagnostics, screenshots and download metadata when those features are requested; and
  • page text, semantic JSON, screenshots, PDFs, downloads or short video only when an artifact capture is explicitly requested.

brw does not access Chrome's password store, passkey store or profile files. The installed-profile extension refuses every cookie CDP method and the bulk-storage CDP domains, including access to HttpOnly cookies. Sensitive form fields and sensitive request headers are redacted from normal semantic observations. If you explicitly ask an agent to work with sensitive page or form content, brw may still handle personal, communication, financial, health, location or authentication information needed for that task.

How the data is used and shared

Browser data is used solely to provide the user-facing purpose of letting the agent you selected read and control visible browser tabs. The extension connects only to the loopback daemon configured in its options. It does not connect to a Don Works, Revitt, advertising or analytics server.

If you connect brwd to a third-party agent or model service, browser observations requested by that agent may be returned to that service through your chosen MCP or HTTP setup. You choose and configure that recipient; its privacy terms apply. brw does not add another publisher-operated recipient.

Storage and retention

  • The extension stores only local bridge endpoints, optional profile labels, your enable/disable choice and connection status in Chrome local storage.
  • Ordinary page observations are relayed to the local daemon and are not retained by the extension.
  • Explicit browser-host artifacts are stored in an owner-only local directory managed by brwd. They have configurable size and retention limits and can be inspected or deleted through brw's artifact tools.

How the extension works

The extension connects only to a brw daemon running locally on your own computer over ws://127.0.0.1 / ws://localhost. It uses Chrome's debugger protocol to drive visible tabs on your instruction and report back what happened. The Chrome-to-daemon hop stays on the same computer. For a remote setup, you configure your own SSH connection and the browser profile remains on the browser host. brw operates a normal, visible browser — it adds no stealth, CAPTCHA bypass, MFA bypass or consent bypass.

Your controls

You can disable browser control at any time in the extension's Options page; this closes the daemon connection and releases tabs attached through the debugger. Uninstalling the extension removes its Chrome-local settings. Explicit artifacts and daemon configuration stay in your local brw data directory until you delete them with brw's artifact tools or from that directory.

Permissions, and why

  • debugger — drive tabs via the Chrome DevTools Protocol (open, read, click, type), the core of browser control.
  • tabs / tabGroups — see and organise the tabs brw is acting on.
  • notifications — alert you at human-handoff points (MFA, CAPTCHA, purchase confirmation) and on completion or error.
  • webNavigation, alarms, storage, offscreen — track navigation, keep the local connection alive, and store local connection settings. None of this leaves your device.
  • downloads — identify downloads started by the tab brw is controlling, so the requested file can be reported or captured without confusing it with a human download from another tab.
  • Host access is restricted to 127.0.0.1 and localhost — the local daemon only.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. brw uses browser data only for its disclosed user-facing browser-control purpose. It is not sold, used for advertising, used to determine creditworthiness, or made available for humans at Don Works or Revitt to read.

Open source

brw is open source under AGPL-3.0. You can read exactly what the extension and daemon do, including this behaviour, on GitHub.

Contact

Questions about privacy? Open an issue on the brw repository or reach Revitt.

brw · part of Don Works · open source by Revitt · AGPL-3.0