Privacy policy — Swiftab

Last updated: 20 October 2026

Swiftab is a browser extension that automates a browser tab toward a goal you give it. It decides each click, keystroke and dropdown choice with a decision model, writes typed text with a small text model, and asks a thinking model for a way forward when a run is stuck. The extension runs on a code you buy from its publisher, on one of two plans. On the own keys plan you configure the three models yourself, with your own API keys. On the credit plan the publisher provides them, through Swiftab's server, and you pay for them with credits. This policy says what the extension does with data. It is published by AdsMediaMix.

What the extension does with data

• Nothing happens until a run starts. The extension reads a tab only after you type a goal and press Run or Step, or after a local agent that you enabled asks it to work. It then works only in the tab of that run. Several tabs can each have a run of their own at the same time.
• Each step of a run sends one request to the decision-model provider you chose (OpenRouter, TypeSafe or Cloudflare Workers AI; on the credit plan, Swiftab's server, as described below). The request contains your goal, the tab's address, title and visible text (up to 6,000 characters, and up to 1,500 more for each embedded frame), and, when your goal compares items ("the cheapest", "the newest", "all results"), one line of text for each item of the page's main list, also those scrolled out of view (up to 3,000 characters); when the page's form goes on out of view, one line for each of its fields with its current value or choice, also those out of view (up to 2,500 characters; password fields are never included), the list of interactive elements with their labels, current values and link targets, and the last ten actions taken.
• When a field needs typed text, one request goes to the text model you chose (OpenRouter, DeepSeek or an OpenAI-compatible endpoint) with the goal, the field's label and the same page text. When a local agent is driving, the text comes from that agent instead.
• A thinking model is asked a few times in a run, five at most: for a short plan before the first step when the task needs one, when the run is stuck, to check that a task is finished when the page cannot show it, and for a long text the text model could not write. The request goes to the provider you chose for it (OpenRouter by default, with the key you entered for the decision model there; or OpenAI or an OpenAI-compatible endpoint, with a key of its own). It contains your goal, the tab's address and title, the first 1,500 characters of its visible text, up to 80 of its interactive elements with their labels and current values, and the last actions with the start of any text that was typed; when a finished task is checked, also how long that text was and its last 60 characters. When the run is stuck or a finished task is checked, a picture of the tab as it is drawn goes with the request, and a picture shows whatever is visible in that tab. In Options you can switch off the pictures, or the thinking model as a whole. It is not asked while a local agent supervises the run.
• Password fields are never read or filled. On the sign-in and app-permission pages of major account providers (Google, Microsoft, Apple and Yahoo accounts, and the sign-in pages of Facebook, GitHub, LinkedIn and X), the extension reads but does not act. Browser-internal pages such as chrome:// are refused.
• There is no telemetry. No analytics, no advertising, no crash reporting.

Your Swiftab code

• The code is checked with Swiftab's server (swiftab-recipes.vercel.app, run by the publisher). The code and a random identifier of this Swiftab install, and nothing else, are sent there when you save the code, and after that at most every three hours, when you start something. The identifier is made by the extension and says nothing about you or your computer; it lets a code run in one Chrome at a time. The server answers with your plan, whether the code stands and until when, and on the credit plan your balance; that answer is kept on your device.
• What the server keeps for each code: the email address it was sold to, the plan and its end date, which install holds the code, and when the code moved to another one; on the credit plan also the balance and the record of credits described below. The code itself is kept only as a hash.
• On the own keys plan your pages do not pass through it. The requests to the models described above go from your browser straight to the providers you configured.
• On the credit plan those requests go through Swiftab's server instead, which passes them on to OpenRouter with the publisher's key: each step's request for the decision model, and each request for a field's text and each question to the thinking model, with its picture where one is sent. They contain what is described above, the thinking model you chose of the two offered (Gemini 3.8 Flash or Claude Sonnet 5.5), and your code. The server reads a request to check its shape and to pass it on. It does not store goals, page content, pictures or answers. For each request it records the time, the kind of request, the credits taken, the number of tokens the provider counted and what the provider charged for it, against your code. The platform it runs on keeps its own access logs (time, address and path of a request).

Buying a code

When you buy a code on the publisher's sales page, the page sends your email address, the name you give and the period or pack of credits you chose to Swiftab's server, which creates the invoice at Konvert (konvert.id), the payment service. Konvert and its payment gateway handle the payment under their own terms; the server does not see your payment details. The server keeps the order (email address, name, period or credits, amount and whether it was paid) and shows the code on the thank-you page that Konvert sends you back to, which only someone with that page's address can open.

Local agents (off by default)

When you turn on Allow local agents in Options, the extension connects to programs on your own computer, at the loopback address 127.0.0.1: the port you set and the seven above it, one program each (one for each Claude session at work). Each program can give the extension goals, read the tab of the run as the extension sees it (the information listed above, and a picture of that tab when the program asks for one or when a run asks it for help), send it one operation at a time, and read or change your site recipes. It can attach a file to a page's file field only when you have allowed the extension access to file URLs in Chrome and the program names the file.

Nothing leaves your computer through this connection. What the program then does with what it reads is governed by that program and its provider.

Site recipes, and team recipes (off by default)

The extension keeps recipes on your device: for a site, a few lines of guidance, field hints, and named lists of steps. Lists of steps can be learned from runs that finished. What you typed is never stored in them; it becomes a parameter.

When you turn on Sync recipes with the team's server and enter a server address and a member token, the extension sends your recipes (the site's host name, guidance, hints and step lists) to that server, and fetches your team's recipes from it when the browser starts, every 15 minutes, and when you press the button. Page text is never sent to it. That server is run by whoever gave you its address and token, and they can see the recipes and the email address your token belongs to.

What is stored, and where

• Your settings, API keys, Swiftab code, member token and recipes are stored in the browser's extension storage on your device, with the server's last answer about the code and the install identifier. A key or token is sent only to the service it belongs to, and the code only to Swiftab's server, as an authorization header. One exception: when local agents are allowed and the Swiftab server for Claude Code on your computer says it updates itself, the extension hands it the code (and nothing else from the settings), and that server uses it only to fetch its own updates from Swiftab's server.
• The log of a run (the decisions shown in the popup) is kept in memory while the extension is awake and discarded afterwards. Copy trace puts a run on your clipboard only when you press it.

How the data is used

Data is used only to do what the extension is for: automating the tab toward your goal. It is not sold, not transferred to anyone except the services named above as part of that work, and not used for advertising or to judge creditworthiness. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Third parties

The providers you configure process the data described above under their own terms and privacy policies: OpenRouter, TypeSafe, Cloudflare, DeepSeek, OpenAI, or the OpenAI-compatible endpoint you enter. On the own keys plan the publisher of Swiftab has no access to that data. On the credit plan the requests pass through Swiftab's server as described above to OpenRouter, which processes them under its own terms and passes each to the provider of the model: TypeSafe for decisions, Inception for a field's text, and Google or Anthropic for a question to the thinking model, whichever you chose. Payments for a code are handled by Konvert under its own terms.

Permissions

• activeTab, tabs, scripting and access to all sites: to read the tab of a run, to place the page script that carries out clicks and typing, to open a tab of the agent's own, to follow a tab that one of its clicks opened, and to close the tabs it opened when the task ends. Other tabs are not read.
• tabGroups: to put the tab being automated into a labelled group, so you can tell which tab it is.
• webNavigation: to see the frames inside the tab of a run, and which tab a newly opened tab came from.
• storage: to keep your settings, keys, Swiftab code with the server's last answer about it, the install identifier and recipes on your device.
• alarms: to reconnect to a local agent you enabled, to fetch team recipes on schedule when you enabled that, and to take the "being automated" mark off a tab after a while.
• debugger: to send the clicks and keystrokes of a run to its tab through Chrome's DevTools protocol, so the page receives real input; to keep that tab drawing while it is behind another window; to hand a file you named, through a local agent you enabled, to a page's file field; and to take a picture of that tab for the thinking model or for a local agent you enabled. It is attached only to the tab of a run and let go shortly after the last operation. Chrome shows a "started debugging" bar while it is attached. You can turn this off in Options.

Changes

When this policy changes, the date at the top changes with it.

Contact

Questions: sales@adsmediamix.id