Is Your AI Chrome Extension Safe? Zero Retention Explained

Is Your AI Chrome Extension Safe? Zero Retention Explained

You installed it in about eight seconds. Chrome Web Store, four and a half stars, a nice icon, one line that says "AI assistant for any page." You clicked "Add to Chrome," maybe skimmed the permission list, maybe didn't. Then you went back to work and let it sit there reading your tabs.

That's how most of us adopt browser extensions now. And honestly, it's a reasonable way to live — you can't read a 40-page privacy policy every time you want a better way to summarize a PDF. But AI extensions deserve a closer look than most, because of what they're built to do. An AI assistant in your browser isn't just sitting there. It's designed to read the page you're on. Sometimes to type into it. Sometimes to click things.

Which raises a fair question: where does all that content go?

This post walks through what "zero retention" actually means, why it matters more for AI extensions than for, say, a coupon-finder, and how to tell whether the tool in your toolbar is trustworthy. I'll use SideKik as a working example throughout, partly because it's the product I know best and partly because its privacy model is unusually specific — no background scanning, no stored prompts, no training on your conversations. But the framework applies to any extension you're considering, including ones I've never heard of.

By the end you'll know what to look for in a privacy policy, what questions to ask, what the trade-offs of zero retention really are, and how to audit any extension yourself in about ten minutes.

What "Zero Retention" Actually Means in Plain English

Let's start with the term itself, because "zero retention" gets thrown around loosely.

When you use any cloud-based AI tool — a chatbot, an extension, a writing assistant inside Google Docs — some of your text leaves your computer. It has to. The model doesn't run locally on your laptop; it runs on servers owned by whoever built the model. Your prompt travels there, the model generates a response, and the response comes back.

The question is what happens to that text after the answer is generated.

Retention is a record-keeping practice. A company that "retains" your data keeps a copy of your prompt, the page content it read, and often the response, in a database or log file. The reasons vary, and some are legitimate: debugging, abuse prevention, billing, improving the product. Retention periods might be 30 days, 90 days, a year, or indefinitely.

Zero retention means the opposite. The company processes your request, returns the answer, and then discards everything. No log file. No database row. No "we keep it for 30 days for quality purposes." The data exists for the duration of the request and then it's gone.

That's the whole idea, and it's a meaningful difference. But it's also easy to claim and hard to verify, so let's dig into the mechanics.

The difference between "we don't sell your data" and "we don't keep it"

These two things get conflated all the time, and they are not the same.

"We don't sell your data" is a statement about distribution. The company keeps your information; it just doesn't hand it to advertisers or data brokers. Plenty of reputable companies operate this way. It's a real commitment. It's also not the same as not having the data at all.

"We don't retain your data" is a statement about existence. There's nothing to sell, nothing to subpoena, nothing to leak in a breach, because the data isn't there anymore. A breach of a zero-retention system exposes far less than a breach of a system that keeps six months of prompts.

For an AI browser extension specifically, the second promise matters more than the first. Here's why: the content flowing through an AI extension is often the most sensitive stuff on your screen. Contracts. Medical portals. Internal dashboards. Half-finished performance reviews. Your boss's Slack message. A draft of a resignation letter you haven't sent yet. If a tool retains that, it's holding a copy of your work life.

What actually gets sent when you use an AI extension

It helps to be concrete. When you invoke an AI assistant on a webpage, roughly three things can travel:

1. Your prompt — the question or instruction you typed.
2. Page context — some or all of the visible text on the page, so the model can answer questions about it.
3. Metadata — timestamps, token counts, model version, sometimes your account ID.

A well-designed extension sends only what's needed for the request. A carelessly designed one might send the entire DOM of the page, including hidden fields, comments in the HTML, and elements you can't see.

And then there's the fourth thing that shouldn't travel but sometimes does: your data in aggregate. Some products reserve the right to use your conversations to improve their models. That's a retention practice dressed up as product development. It means your prompt about a client contract might end up as training data for a future model version.

Zero retention rules all of that out. Or at least, it should.

Why AI Chrome Extensions Carry a Different Kind of Privacy Risk

A PDF viewer extension can't do much damage. It opens PDFs. An AI extension has dramatically more reach, and it's worth understanding exactly why.

The permission problem

Chrome extensions declare permissions in a manifest. Three of them matter most here:

• activeTab — access the current tab, but only after you click the extension.
• tabs — see tab titles and URLs, sometimes more.
• <all_urls> or host permissions — access content on every site you visit.

An AI extension that works "on any website" typically needs broad host permissions. That's unavoidable if the goal is to understand whatever page you're on. But broad permission is also broad capability. In the wrong hands, or with a bug, it's a lot of surface area.

The distinction that matters is between permission and behavior. A tool can have permission to read every page and still only read the page you explicitly invoke it on. Or it can have that permission and quietly scan everything.

SideKik sits firmly in the first camp: it has the permissions needed to work across sites, but it reads the active page only when you open it. No background scanning, no harvesting of your browsing history, no keystroke logging, no access to saved passwords. The permission is there; the behavior is narrow.

The copy-paste workaround isn't as safe as it feels

Here's an argument I hear a lot: "I just copy the text into ChatGPT instead. That way I'm in control."

It feels safer. Is it?

Somewhat, yes — you're curating exactly what leaves your machine, which is genuinely valuable. If a page contains your account number, you can leave it out.

But the destination matters too. If you're pasting into a consumer chatbot whose terms allow training on your inputs, you've traded a controlled-but-broad extension for an uncontrolled-but-narrow paste. Depending on the chatbot's settings, your pasted content may be stored for months and used to improve models. That's a real trade, and it's not obviously in your favor.

The point isn't that one approach wins. It's that the copy-paste habit gives you a false sense of security if you never checked where the paste lands.

What a breach would actually expose

Let's make the stakes concrete with a thought experiment.

Imagine two AI writing assistants. Both work great. Both cost $9 a month.

Assistant A keeps prompts and responses for 12 months "to improve quality." It has 200,000 users. One day, an attacker gets into a database backup.

Assistant B retains nothing. Same attacker, same credentials, same bad day.

For Assistant A, the leaked data could include millions of prompts: emails people drafted, code they pasted, customer records they summarized, legal language they workshopped. That's a catastrophe for the users, most of whom never imagined their prompts were sitting in a database.

For Assistant B, there is no archive to steal. The attacker gets infrastructure access, maybe, but not a year of your writing.

This is the core argument for zero retention. It's not about trusting a company's intentions. It's about removing the thing worth stealing.

The Questions to Ask Before Installing Any AI Extension

Here's a checklist you can run through in a couple of minutes. I'd apply it to every AI tool in your browser, not just the one this article is about.

1. Does it read pages in the background, or only when I ask? Look for the phrase "on-demand" or "when invoked." If the answer is vague, that's an answer.

2. Is there a retention policy stated explicitly? "We take privacy seriously" is not a policy. Look for a specific claim: zero retention, X-day retention, or a data retention section with actual numbers.

3. Are conversations used for model training? Many products bury this. Search the policy for "train," "improve," and "quality."

4. What permissions does it request, and do they match the features? A summarizer that wants access to your clipboard and your downloads is a red flag. Check chrome://extensions → Details → Permissions.

5. Can you delete your account and data in one click? Or does it require an email, a support ticket, and a two-week wait? Friction in deletion is a signal.

6. Does it handle authentication or passwords? A browser assistant has no business touching your password manager. If it asks, walk away.

7. Who processes the data — the extension maker, or a third party? Almost all AI extensions route through a model provider. The good ones state that provider-side data isn't retained either.

8. Is there a free tier you can test before paying? Not a privacy question, but a practical one. You learn more in ten minutes of use than ten minutes of reading.

Print that list mentally. It'll serve you well.

How SideKik Handles Data: An Honest Walkthrough

Now let's make this concrete with a specific product, including the parts that aren't flattering.

SideKik is a Chrome extension that puts an AI assistant into whatever page you're viewing. It does three things: chat with the page, act on the page, and help you write inside text boxes. It's free to try — 50,000 tokens a month, no card — and $9 a month for Pro with 5 million tokens.

Here's what happens to your data at each step.

Step 1: You invoke it

Nothing happens until you do. There's no background process reading your tabs, no agent quietly building a profile of the sites you visit. You click the extension icon, or the sparkle button on a text field, and only then does it look at the page you're on.

That's the pattern I'd want from any assistant: dormant until asked. It also means the tool is useless for the kind of passive surveillance that makes some extensions creepy. It can't build a behavioral profile, because it isn't running.

Step 2: Your prompt and page context go out

When you ask "summarize this" or "what's the cancellation policy here," SideKik packages your question with the relevant page content and sends it to generate an answer.

This is the part where most privacy policies go quiet. So here's the specific claim: prompts and page content are sent only to generate the answer and are then discarded. Not stored. Not logged. Not retained.

That's zero retention, and it applies to the page content as much as to your typed question. Which matters, because the page is often the more sensitive part.

Step 3: The model provider's side

Every AI product depends on a model, and most depend on someone else's. That creates a second retention question: does the model provider keep your data even if the extension maker doesn't?

SideKik states that conversations aren't used to train AI models — neither its own nor its providers'. That's the crucial second half of a zero-retention claim, and it's the half people forget to check.

Step 4: Actions require your approval

SideKik can do things on a page: fill a form with your details, find the cheapest option, click through to an invoice or an author profile. Commands like these are handled with user approval rather than executed silently. You see what it's about to do, and you decide.

That's a small design decision with large privacy implications. An assistant that acts without asking is one bad instruction away from doing something you didn't want.

Step 5: Account deletion

One click. Personal data removed, no dark patterns, no "are you sure?" maze, no waiting period. This is the least glamorous part of privacy design and one of the most revealing. If a company makes leaving hard, it tells you something about how it views your data.

If you already use privacy-first tools elsewhere — encrypted email, for instance, or a VPN — you're probably familiar with services that build their reputation on treating data as a liability. Companies like Proton have spent years making that argument in the email and productivity space; SideKik is applying a similar logic to the AI-in-your-browser category.

What SideKik explicitly doesn't do

Because negative claims are often more informative than positive ones:

• No background scanning of pages
• No collection of browsing history
• No keystroke logging
• No access to your passwords
• No use of conversations to train models
• No storage or logging of prompts and page content

If any of those show up later in a changelog, that's your signal to reconsider.

A Quick Comparison: Three Ways to Get AI Help on a Webpage

Approach	What leaves your machine	Typical retention	Context switching	Can act on the page?
Copy-paste into a standalone chatbot	Exactly what you paste	Often 30 days+; may be used for training depending on settings	High — new tab, re-paste, lose your place	No
AI extension with standard retention	Prompt + page context	Varies; often logged for debugging or quality	Low	Sometimes
AI extension with zero retention (e.g., SideKik)	Prompt + page context; discarded after the response	None	Low	Yes, with approval

The table isn't a verdict. The copy-paste route has real advantages: you control exactly what's shared, and you're probably already paying for that chatbot. But if you're doing it twenty times a day — summarizing docs, drafting replies, pulling numbers out of dashboards — the friction adds up, and the retention story at the other end may be worse than the extension you were avoiding.

Common Mistakes People Make When Judging AI Extension Safety

I've watched a lot of people evaluate these tools, and the same errors come up repeatedly.

Mistake 1: Trusting the star rating. Reviews measure whether the tool works, not whether it's careful with your data. A five-star extension can have a terrible privacy model.

Mistake 2: Assuming "open source" equals "safe." Open source is a genuine plus — the code can be inspected. But an extension can be open source and still send your data to a server you've never heard of. Read the network calls, not just the repo.

Mistake 3: Confusing "we don't sell data" with "we don't keep data." Covered above, but it's the single most common mix-up.

Mistake 4: Ignoring the permission list. Chrome shows you exactly what an extension can access. It takes fifteen seconds to look. Almost nobody does.

Mistake 5: Believing that a privacy policy is the same as a privacy practice. Policies are promises. Practices are what actually happens. You can't fully verify either from the outside, but you can look for specificity: named retention periods, named model providers, explicit training statements. Vagueness is the tell.

Mistake 6: Forgetting about the model provider. Your extension might be perfectly clean while its upstream API logs everything. Ask about both.

Mistake 7: Never testing deletion. Sign up for the free tier, then delete the account. If it takes more than a click or two, make a note.

Mistake 8: Assuming enterprise tools are automatically safer. Sometimes they are. Sometimes they're the same consumer product with a different invoice.

Zero Retention in Practice: Four Realistic Scenarios

Abstract privacy talk is easy to nod along to and hard to apply. So here are four situations where the retention question has a concrete answer.

The grad student knee-deep in PDFs

She's reading 30 papers a week for a literature review. Half of them are PDFs she can't search properly, and the other half are HTML articles behind library logins. She needs summaries, key findings, and comparisons across sources.

Her risk profile: low stakes individually, high volume. If an extension logged every paper she read and every question she asked, that's a detailed picture of her research interests and, over a semester, her thinking. Not catastrophic, but not nothing. Zero retention means her reading list stays hers.

The practical win is speed. Asking "what's the sample size and main limitation here?" and getting an answer without leaving the PDF is the difference between reading 30 papers and reading 15.

The sales rep with a messy CRM

He lives in a browser. His CRM, his email, LinkedIn, a quoting tool, three internal dashboards. His most repetitive task is copying account details from one system into another — names, addresses, contract values — dozens of times a day.

His risk profile: high. Customer data, pricing, contact information. If an extension retained that, it would be holding a copy of his pipeline. His company's legal team would have opinions.

This is where action-on-page features earn their keep: "fill this form with my details," "find the invoice for this account." With approvals on each action, and no retention after the response, the workflow gets faster without creating a shadow copy of the customer database.

The freelance writer on deadline

She writes in five different CMSes depending on the client. Drafting in a browser text box, then switching to a chatbot to fix a paragraph, then pasting back, is the kind of friction that eats an hour a day.

Her risk profile: moderate to high. Embargoed client work, unpublished drafts, sometimes legal or financial content under NDA.

Inline writing help — a sparkle button on the text box, reply generation, rewording, shortening, translation — removes the tab-switching. And a zero-retention claim is what makes it defensible to her clients. "I ran your draft through a tool that keeps nothing" is a sentence she can say out loud.

The privacy-conscious user who just doesn't want another tracker

This person isn't a target customer for most AI tools. They use encrypted email, they block third-party cookies, they read the changelog. They're not anti-AI; they're anti-surveillance.

Their risk profile: they'll simply refuse anything that retains. For them, the absence of retention isn't a feature — it's the price of entry. Products that pair AI capability with a strict data posture are the only ones that get considered at all.

If you're in this group, the useful test is the same one you apply elsewhere: can I delete everything in one click, and does the company make money without monetizing my data? Subscription pricing is a good sign. If you're not paying, the product has to be paid for some other way.

How to Audit Any AI Extension Yourself in Ten Minutes

Here's a repeatable process. It works on SideKik, on competitors, and on whatever launches next month.

Minute 1–2: Check permissions. Go to chrome://extensions, find the extension, click Details, and read the permissions list. Ask yourself whether each permission is necessary for the stated features.

Minute 2–4: Read the privacy policy — selectively. Don't read it top to bottom. Use Ctrl+F for: "retain," "retention," "train," "third party," "log," "store." You'll find the real answers in about six searches.

Minute 4–6: Check the data-handling section for specifics. Look for named retention periods or an explicit zero-retention claim. Look for a named model provider or an explicit statement about provider-side handling. Vague language here is a meaningful signal.

Minute 6–7: Test the free tier with throwaway content. Write a sentence you don't care about, ask the assistant to reword it, watch the behavior. Does it read the page without being asked? Does it pop up unprompted?

Minute 7–9: Test deletion. Sign up, poke around, then delete the account. Count the clicks. Note whether you get a confirmation email or a "we'll process this in 30 days" message.

Minute 9–10: Check the update history. On the Chrome Web Store listing, look at when it was last updated and what changed. Extensions that add permissions in later updates deserve a second look — permission creep is real.

Ten minutes. That's the whole thing. Run it once and you'll have a much better sense of what's sitting in your toolbar.

The Trade-offs of Zero Retention (Let's Be Honest)

Zero retention isn't free, and pretending otherwise would make this post less useful.

You lose cross-session memory. A retention-based assistant can remember that you prefer British spelling or that you're working on a specific project. A zero-retention one starts fresh. SideKik's approach means each conversation stands alone — which some people find limiting.

Debugging gets harder. When something goes wrong, logs help. A product that keeps nothing has less to work with when you report a bug. That's a real cost, and it's part of why zero retention is a choice rather than an obvious default for every company.

Verification is still hard. You're trusting a vendor's description of its own infrastructure. Unless a company publishes independent audits, "zero retention" remains a claim. You can look for consistency — does the privacy page, the pricing page, and the FAQ all say the same thing? — but you can't crawl their servers.

Some features become impossible. Personalization over time, shared conversation history across devices, "pick up where you left off" — all of these require storage. If you want them, you'll trade away some of the privacy benefit.

The reasonable position: zero retention is the right default for a tool that reads your screen, and the lost features are mostly nice-to-haves. But if persistent memory is essential to your workflow, a zero-retention tool will frustrate you.

Pricing, Plans, and What You're Actually Buying

One more angle on the trust question: how does the company make money?

SideKik's free plan gives you 50,000 tokens a month — enough for casual use, chat, page actions, and inline writing. No credit card. The Pro plan is $9 a month for 5 million tokens, priority responses, and cancel-anytime terms.

That structure matters for privacy reasons. When a tool is free and unlimited, the business model has to come from somewhere — ads, data, or a paid tier you haven't noticed yet. Token-metered subscriptions mean the incentive is to keep you as a paying customer, not to extract value from your content.

There's also the setup dimension: no API keys, no model selection, no config files. You sign in with Google or a magic code and start using it. That matters more than it sounds. The people most likely to mishandle a self-hosted AI setup — pasting keys into scripts they don't understand, running models with no idea where outputs go — are often the same people who'd benefit most from a tool with a clear data policy.

A Five-Point Checklist You Can Steal

Before you install, or before you keep using something you already have:

1. It reads pages only when you invoke it — no background scanning.
2. It states a specific retention policy, preferably zero.
3. It says explicitly that conversations aren't used for training.
4. It asks for approval before acting on a page.
5. You can delete your account and data in one click.

Five points. Anything that fails three of them is probably not worth the toolbar space.

FAQ

Is zero retention the same as end-to-end encryption? No. Encryption protects data in transit and at rest; zero retention means there's no data to protect at rest because it isn't kept. They solve different problems. Encryption matters most for stored data; retention policy matters most for data that could otherwise pile up.

If nothing is stored, how does the AI answer my question? The data is held in memory for the duration of the request. Your prompt and the page content are sent, the model generates a response, the response comes back to your browser, and the working copy is discarded. Processing requires temporary access; it doesn't require a permanent copy.

Does a zero-retention AI extension still see my whole page? It sees what it needs to answer your question, and only after you invoke it. A well-built extension pulls relevant page content at the moment of the request rather than hoovering up everything in advance. The important distinction isn't whether it can read the page — you asked it to — but when and how much.

Can my employer's security team approve a tool like this? Increasingly, the question they ask is "what's the retention policy and the training policy?" If both answers are "none," the conversation is much shorter. You'll still want a written policy to point at, which is why specificity matters more than reassuring adjectives.

What about the underlying model provider? That's the second half of the question most people miss. An extension can promise zero retention on its own side and still route through a provider that logs requests. Look for an explicit statement covering provider-side handling, not just the extension's own servers.

Does a free plan mean my data is the product? Not necessarily. Many freemium tools use a token limit as a natural upgrade path, and the paid tier funds the free one. But it's a fair question to ask, and the answer lives in the retention policy. If the policy is vague, the free tier is a bigger risk than the paid one.

Is SideKik free to try? Yes. 50,000 tokens a month, no credit card, full access to chat, page actions, and inline writing. Pro is $9 a month if you find yourself hitting the limit.

What happens if I stop using it? You delete the account in one click and the personal data is removed. No waiting period, no dark patterns.

Where This Leaves You

The uncomfortable truth about AI extensions is that they ask for a lot of trust. Access to every page you visit, the ability to read content and act on it, the right to sit inside your text boxes. That's a wide door, and most of us opened it while waiting for a meeting to start.

You don't have to become a privacy researcher to use these tools safely. You just have to ask two questions before you install anything: When does it read my pages? and What happens to what it reads?

An assistant that waits to be asked and keeps nothing afterward is a fundamentally different proposition from one that scans continuously and stores everything. The first is a tool. The second is a relationship you didn't agree to.

If you want to test that difference, the free plan on SideKik is a low-stakes way to try it. Open it on a page you were going to read anyway — a long article, a PDF, a dashboard full of numbers — ask a question, and watch what happens. Then close the tab and see whether anything lingers. It won't.

Your browser is where a lot of your life happens. It's worth ten minutes to know who's reading along.