Privacy Policy

SiteMoves (“we”, “the extension”) is a Chrome extension that records and replays browser actions. This policy explains what data we collect, how we use it, and your rights.

Data stored on your device

Most data SiteMoves creates stays on your device, in Chrome's built-in storage (chrome.storage.local). This includes:

• Saved Moves (name, recorded steps, target selectors, input values, site domain, timestamps)
• Usage statistics (run counts, daily cost)
• Preferences (display settings)

Your Moves are stored locally and are not uploaded to our servers during normal recording, saving, or replay. They leave your device only if you explicitly share a Move (see “When you share a Move” below) or use Run Mode (see “Data sent to external services”). A small amount of account data — your usage counters — syncs to our servers so your run counts follow you across devices; this contains no Move content.

Data sent to external services

Run Mode only: When you use the Run tab to execute a task with AI, SiteMoves sends the following to our server, which forwards it to OpenAI's API:

• Your typed goal (e.g. “Cancel my subscription”)
• The current page's visible text content (DOM structure, button labels, link text)
• Tool call results (confirmation that a click or input was executed)

This data is sent over HTTPS to our server (hosted on Supabase), which proxies it to OpenAI. Our server records only billing metadata — token counts, cost, model used, and your device or account identifier — to meter usage. We do not store your goal text, page content, or tool results. OpenAI's data usage policy applies to the content forwarded to them.

If you provide your own OpenAI API key (BYO-key), requests go directly to OpenAI and bypass our server. Your key is stored locally in chrome.storage.local and is never sent to us.

No page content, passwords, or form values are sent during Record or Replay — those operations are entirely local.

When you share a Move

Sharing is optional and requires sign-in. When you click Share on a Move, the full Move — including its recorded steps and any non-sensitive input values (such as search terms or dropdown selections) — is uploaded to our servers so it can be opened via a link.

Before upload, SiteMoves:

• Redacts sensitive fields (passwords, payment card numbers, one-time codes) detected during recording — these are stored as [REDACTED] and never uploaded
• Sanitizes email addresses found in input values
• Shows you a preview that flags any detected personal information, so you can cancel before sharing

Only Moves you explicitly choose to share are uploaded. Recording, saving, and replaying never upload your Moves.

What we do not do

• We do not use analytics services (no Google Analytics, no Mixpanel, no tracking pixels)
• We do not set cookies or use browser fingerprinting
• We do not require an account to record, save, or replay Moves — sign-in is optional and only needed to share Moves or subscribe to Pro
• We do not share your data with third parties other than OpenAI (for Run Mode), our payment processor Stripe (for Pro subscriptions), our hosting provider Supabase (account data and shared Moves), and Google (OAuth sign-in, if you choose to sign in with Google)
• We do not collect browsing history, bookmarks, or data from pages you do not interact with via SiteMoves
• We do not inject advertisements

Accounts and sign-in

You can use SiteMoves' core features — recording, saving, and replaying Moves — without an account. Sign-in is optional and unlocks sharing, the Pro subscription, and additional Run Mode executions.

• Anonymous use is identified by a random device ID generated on your device.
• Signing in (Google or email) creates an account identified by a user ID; your device's existing history is linked to that account on first sign-in.

Sign-in is handled by Supabase authentication. We receive your email address for account identification and login.

Permissions we request and why

SiteMoves requests the following browser permissions:

• Host access (all websites): Records and replays browser actions on any website you choose
• Active tab: Grants access to the current tab when you click the SiteMoves icon
• Tabs: Detects page navigation during replay so the next step runs on the correct page
• Scripting: Injects the content script that performs record and replay on each page
• Storage: Saves your Moves and settings locally
• Alarms: Keeps the background process alive during multi-step AI tasks so they complete without interruption
• Side panel: Provides the optional side-panel UI
• Identity: Enables Google sign-in

Google API disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Recorded input values

When you record a Move, SiteMoves captures the text you type into form fields. This may include personal information (names, addresses, email addresses). These values are stored locally in the Move and replayed when you run it.

If you share a Move, non-sensitive input values are included in the upload (see “When you share a Move” above). Sensitive fields are redacted before upload.

Important: Review your recorded steps before saving, especially if you typed sensitive information. You can delete individual steps in the review screen or delete the entire Move from My Moves at any time.

Your rights

• View: All saved Moves are visible in the My Moves tab
• Delete: Delete any Move via the trash icon in My Moves
• Reset: Clear all data (Moves, stats, preferences) via Settings > Reset all data
• Uninstall: Removing the extension deletes all locally stored data

Children's privacy

SiteMoves is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information through SiteMoves, please contact us and we will assist with deletion.

Changes to this policy

We may update this policy as features are added. Material changes will be noted in extension update notes. Continued use after changes constitutes acceptance.

Contact

Questions or concerns: hello@sitemoves.app