Browser Extension Privacy Policy

Only on a tab you point it at — by clicking the extension, using its keyboard shortcut, or asking the paired CLI for that tab:

• the page's URL, title and DOM;
• console messages and network requests of that tab, while a session is active;
• screenshots of the visible area, when asked for one.

It does not read tabs you have not targeted, it does not run in the background on every site you visit, and it keeps no browsing history of its own.

To a program on your own computer. The extension talks to the Orquesta bridge over a WebSocket bound to 127.0.0.1, and the bridge talks to Orquesta CLI on the same machine. Page content, console output and screenshots go there and nowhere else. The connection is established only after you type a pairing code that the bridge prints and that expires in two minutes.

Not to Orquesta's servers. The extension itself sends nothing to getorquesta.com.

One exception you choose explicitly. If you inject the Orquesta embed widget into a page, that widget is an Orquesta product with its own network behaviour: the prompts you write in it, and the console, network and element context you attach to them, are sent to Orquesta and stored against the project the embed token belongs to. That happens only for pages where you deliberately injected the widget, and it is the widget doing it, not the extension. What happens to that data once it reaches us is governed by the Orquesta privacy policy.

In the browser's local extension storage, on your machine: the pairing state with the local bridge, your embed token if you entered one, and your settings. Nothing is synced to a Google account or to Orquesta.

• No analytics, telemetry or crash reporting.
• No advertising, and no sale or sharing of any data.
• No remotely-hosted code: everything the extension runs ships inside the package, including the embed SDK, which is vendored at build time.

• activeTab — Access the page you are looking at, for that visit only, when you click the Orquesta button or press its shortcut. This is what injecting the widget by hand uses.
• debugger — Attach the Chrome DevTools Protocol to a tab you targeted. This is the only API that exposes console history, network request bodies and synthetic input — the whole point of the CLI integration.
• scripting — Inject the Orquesta embed widget into the page when you ask for it.
• tabs — List your tabs so you (or the CLI) can pick which one to act on.
• storage — Keep the pairing state, your embed token and your settings locally.
• alarms — Wake the service worker to re-establish the local connection. Without it Chrome evicts the worker and the pairing silently drops.
• tabGroups— Put the tabs the CLI is driving into one green “Orquesta” group, so you can see which tabs are being automated without switching to them. It touches no other group.
• sidePanel — Show the pairing screen somewhere that survives you alt-tabbing to your terminal to read the code. A popup would close the moment you looked away.
• http://*/*, https://*/* (optional) — Not granted when you install. You turn it on from the popup or the options page, and only if you want the widget to auto-inject on page load or the CLI to inject into a background tab. Revocable from chrome://extensions.
• https://getorquesta.com/*— Relay the widget's own API calls, so a strict Content-Security-Policy on the site you are visiting does not break them. No other host is relayed.
• ws://127.0.0.1/*, http://127.0.0.1/* — Reach the local bridge. Loopback only.

Uninstalling the extension removes everything it stored. Stopping the bridge ends the local connection. Data that the embed widget sent to an Orquesta project is governed by the Orquesta privacy policy and is deleted with the project.

oscar@getorquesta.com