This Privacy Policy provides a complete and transparent account of how Coworker AI collects, uses, processes, stores, retains, and shares your data through the Chrome extension and all related services. It is organized in four numbered parts to address every requirement of the Chrome Web Store Developer Program Policies.
Your password is never stored in plaintext. It is hashed using a one-way cryptographic algorithm at the moment of entry. Only the hash is stored; the plaintext is immediately discarded and is irrecoverable by anyone, including us.
Files are never stored on our servers. Attachments are processed in memory only for the duration of your request, then permanently discarded.
Prompt text is retained for a maximum of 7 days after processing, solely for service continuity and critical error debugging, then automatically and irreversibly deleted.
We do not use your data to train any AI model, including Anthropic's Claude models and DeepSeek models, under any circumstance.
We do not sell, rent, or license your personal data to any third party. Data is shared only with the limited set of sub-processors described in Part 3.
You can request deletion of your data at any time by contacting us at support.coworker@gmail.com. We respond within 48 business hours.
The Coworker AI Chrome extension, our website at coworkerai.com, and all related backend services (collectively, the "Services") are published and operated by Coworker AI Inc. ("Coworker AI," "we," "us," or "our"). Coworker AI Inc. is the data controller responsible for the personal data described in this Privacy Policy.
For all privacy-related inquiries, data access requests, or requests to exercise your rights, you may contact us at:
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
| Term | Meaning |
|---|---|
| Personal data | Any information that relates to an identified or identifiable natural person, as defined under the GDPR and applicable law. |
| Processing | Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, and deletion. |
| Data controller | The entity that determines the purposes and means of processing personal data — in this case, Coworker AI Inc. |
| Sub-processor | A third-party service provider that processes personal data on our behalf, under our written instructions and contractual obligations. |
| Extension | The Coworker AI Chrome extension, available through the Chrome Web Store. |
| Prompt | Any text, instruction, or query you type or dictate into the extension interface. |
| Task | An action or sequence of actions you explicitly instruct the extension to carry out on your behalf (e.g., filling a form, summarizing a page). |
| User | Any natural person who accesses or uses the Services, including website visitors, waitlist subscribers, and extension users. |
| Password hash | The fixed-length output produced by applying a one-way cryptographic algorithm to a plaintext password. A hash cannot be reversed to recover the original password. |
This Privacy Policy applies to all Users of the Services, including all visitors to our website, individuals who join our beta waitlist, and users of the Chrome extension, regardless of their country of residence.
It covers all personal data collected by or on behalf of Coworker AI through:
This Privacy Policy does not govern the practices of third-party websites, applications, or services that may be linked to or accessible from our Services. You are encouraged to review the privacy policies of any third-party service you choose to interact with.
The following table lists every category of data you provide directly to us, the circumstances in which it is collected, and the purpose for which it is used.
| Data category | When collected | Purpose | Stored? |
|---|---|---|---|
| Email address | When you join the beta waitlist on our website, or when you create an account | To notify you of access availability; to send service-related communications; to maintain your account | Yes — retained while your account or waitlist entry is active |
| Account password | When you create an account (sign-up) and each time you sign in | To create your account and verify your identity at sign-in. Your password is immediately hashed using a one-way cryptographic algorithm (bcrypt or equivalent) at the moment of entry. Only the resulting hash is stored. The plaintext password is discarded immediately and is irrecoverable by anyone, including us. See Section 4a for full details. | Hash only — the cryptographic hash is stored for the lifetime of your account; the plaintext password is never stored, logged, or accessible |
| Prompt text | Each time you type or dictate a request or message into the extension | Forwarded to the AI inference provider (Anthropic or DeepSeek) to generate a response; retained briefly for service continuity and error debugging | Yes — up to 7 days, then permanently deleted |
| Uploaded or attached files | When you attach a document, image, or other file to a request within the extension | Transmitted to the relevant AI inference provider to generate a contextually informed response; not stored on our servers at any stage | No — processed in-memory for the duration of the request only, then discarded |
| Voice input | When you use the voice dictation feature, if enabled | Converted to text locally using the browser's built-in speech recognition API (via an off-screen document); the resulting text is treated identically to typed prompt text | No — audio is never transmitted to our servers or to any third party; only the transcribed text is used |
| Support correspondence | When you contact us by email or submit feedback through any channel | To respond to your inquiry, investigate your issue, and improve the Services | Yes — up to 2 years to allow handling of related follow-up requests |
The Coworker AI extension and its associated account system collect your password at two specific moments: when you create an account (sign-up) and when you authenticate into an existing account (sign-in). The following explains precisely how passwords are handled at each stage, in full compliance with the Chrome Web Store's requirements for transparency about the collection and processing of user credentials.
When you choose a password during account creation, it is immediately processed using a one-way cryptographic hashing algorithm (bcrypt or an equivalent industry-standard algorithm). This process transforms your plaintext password into a fixed-length hash value that cannot be reversed or decrypted by any party. The resulting hash — and only the hash — is stored in our database. The plaintext password is discarded immediately upon hashing and is never written to disk, logged, transmitted to any third party, or accessible to any member of our team.
When you sign in, the password you enter is processed using the same cryptographic algorithm. The resulting hash is compared against the stored hash associated with your account. If the two values match, access is granted. The plaintext password you enter at sign-in is never stored, logged, or transmitted anywhere — only the hash comparison is performed, and only the stored hash persists.
You are the only person who knows your password. Because we store only a one-way hash and never the plaintext, it is technically impossible for us — or for any party that might gain unauthorized access to our database — to retrieve or reconstruct your password. If you lose your password, we cannot recover it; you must reset it using the password-reset flow, which issues a new credential.
The following data is collected automatically when you use the extension. All collection is strictly limited to what is necessary to deliver the feature in question and is never initiated without a corresponding action by you.
| Data category | When collected | Purpose | Stored? |
|---|---|---|---|
| Active tab content (visible text, DOM structure, and page elements of the page you are on) | Only when you explicitly trigger a Coworker AI action on that specific page (e.g., "summarize this page," "fill this form") | Provides the page context necessary to carry out the task you requested or to generate a relevant response | Yes — up to 7 days as part of the request, then deleted |
| Tab URL and page title | Same circumstances as active tab content above | Provides page identity context; used for attribution within a multi-step task | Yes — up to 7 days as part of the request, then deleted |
| Page interaction data (form fields the extension reads or fills in; buttons and links the extension clicks; elements it navigates to) during task execution | Only during a task you have explicitly started, and only on the site(s) that task requires | Enables the extension to complete multi-step automated actions on your behalf — such as entering data into a form, clicking through a checkout flow, or submitting a request — without you having to perform each step manually | Partial — processed for the duration of the task; retained only as part of the associated request (up to 7 days), then deleted |
| Authentication token | When you sign in to your Coworker AI account | Stored locally on your device via the chrome.storage API and included in requests to our backend to verify your identity and keep you signed in between sessions | Locally — stored on your device until you sign out or uninstall the extension; server-side session records retained for the duration of your active account only |
| Extension preferences (theme, language, keyboard shortcuts, preferred AI model) | When you change a setting in the extension | Remember your preferences between sessions | Locally — stored only on your device via chrome.storage; never transmitted to our servers |
| Technical and diagnostic data (extension version number, browser type and version, operating system type, request timestamps, error stack traces) | Continuously during use of the extension | Diagnose bugs, monitor service stability, detect abuse, and ensure the extension functions as intended | Yes — up to 30 days, then deleted or fully anonymized |
| IP address | Whenever the extension communicates with our backend servers | Necessary to route the network request to our servers; used briefly for rate-limiting, fraud prevention, and security logging | Yes — retained as part of server logs for up to 30 days, then deleted or anonymized |
The extension is a task-automation agent. When you start a task, it may read page elements, enter text you provide or the AI generates, click buttons or links, and navigate across pages — but only on the site(s) required for that task, and only after you explicitly initiate it. The extension never acts on pages in the background, never reads pages you have not directed it to, and never collects or transmits any data without your action.
Our website collects the following categories of data automatically when you visit it:
We do not collect: passwords or credentials for third-party accounts (only your Coworker AI account password, handled exclusively as described in Section 4a); payment card numbers or banking information; precise geolocation coordinates; biometric identifiers; advertising identifiers (IDFA, GAID, or similar); browsing history on sites unrelated to an active task; social network profile data; or any data from pages you visit when you have not explicitly started a task on that page. We also do not collect personal data from children under 13 (see Section 14).
The extension declares the following permissions in its manifest. Each permission is strictly scoped to the functionality described below, and none is used to collect data beyond what is described in this Privacy Policy.
| Permission | Justification and scope of use |
|---|---|
| tabs | Allows reading the state of open tabs (including their URLs and titles) and switching between them. Required to coordinate multi-tab workflows — for example, opening a page as part of a task, retrieving information from it, and returning to the originating tab. Only accessed during an active, user-initiated task. |
| activeTab | Grants temporary access to the currently active tab's URL, title, and content when you explicitly trigger an action. This is the primary permission allowing the extension to read and interact with the page you are on. It does not grant standing access to all pages — access is limited to the tab you are on at the moment you initiate an action. |
| storage | Provides access to the chrome.storage.local API for storing your authentication token and user preferences (theme, language, shortcuts, preferred AI model) locally on your device. Data stored via this API never leaves your device except where explicitly included in requests to our own backend servers for authentication verification. Your authentication token is never sent to any third-party AI provider. |
| scripting | Allows injecting a content script into a webpage to enable the extension to read page elements, fill in form fields, click buttons or links, and otherwise interact with the page to carry out a task you have started. This content script is injected only into pages involved in an active, user-initiated task; it is not loaded onto pages in the background or without your explicit initiation of a task on that page. |
| sidePanel | Allows the extension to display its main user interface in Chrome's native side panel. This enables you to monitor task progress, view AI responses, and interact with the extension while keeping the full web page visible simultaneously. No data is collected through this permission beyond what the extension already accesses. |
| offscreen | Allows the extension to create an isolated off-screen document (not visible to the user) for specific processing operations, including speech recognition for voice-dictated tasks and parsing of attached files. This off-screen document is created only for the duration of the processing operation and is destroyed immediately upon completion. No persistent data is stored in the off-screen context. |
| host_permissions: <all_urls> | The extension requests broad host access because it is designed to automate tasks across any website the user chooses to work on. To fill in forms, submit data, navigate pages, and perform multi-step workflows across arbitrary websites — as determined by the user's own task — the extension must be capable of interacting with any URL. Additionally, this permission allows the extension to communicate with our backend API and our AI inference providers (Anthropic and DeepSeek) over HTTPS. Access to any given page is only initiated when you explicitly start a task on it. The extension does not read, monitor, or interact with any page in the background or without your explicit initiation. |
Coworker AI does not execute remote code. All JavaScript run by the extension is bundled within the extension package as submitted to and reviewed by the Chrome Web Store. The extension does not load scripts from external URLs, does not evaluate dynamically fetched code via eval() or equivalent mechanisms, and does not use <script src="..."> tags pointing to third-party servers. Network requests made by the extension are limited to transmitting your request data to our backend servers and to the AI providers listed in Part 2, and receiving their text responses — no executable code is returned to the extension through these channels.
We process your data solely for the following purposes. We do not process personal data for any purpose other than those listed below.
| Purpose | Data used | Details |
|---|---|---|
| Providing the Services | Prompt text, attached files, active tab content, page interaction data, IP address, authentication token | Processing your prompts and attached files; reading tab content you submit; generating a response through the AI models described in Section 10; carrying out the task you requested — including reading page elements, filling in fields, clicking elements, and navigating across tabs — on the sites that task requires. |
| Account and waitlist management | Email address, password hash | Creating and maintaining your account or waitlist entry; verifying your identity at sign-in using the cryptographic hash comparison described in Section 4a; notifying you when beta access becomes available. |
| Communicating with you | Email address, support correspondence | Responding to support inquiries; sending mandatory service notices (including security notifications you cannot opt out of); sending product update communications where you have given consent. |
| Service monitoring, stability, and security | Technical and diagnostic data, IP address, error logs, request timestamps | Diagnosing and fixing technical errors; monitoring the stability and performance of the extension and backend; detecting and preventing fraud, abuse, automated attacks, and security incidents. |
| Legal compliance | Any data required by law | Meeting our legal, tax, and regulatory obligations; responding to lawful orders, subpoenas, or requests from public authorities; enforcing our Terms of Service. |
We do not process your data for advertising, behavioural profiling, resale, data brokerage, or enrichment of any third-party database. We do not use your prompts, files, tab content, or page interaction data to train, fine-tune, evaluate, or improve any AI model — ours or any third party's.
To generate responses to your prompts and to carry out the actions you request, Coworker AI transmits the relevant prompt text, and any file or tab content you have submitted, to one or more third-party large language model ("LLM") providers. These providers process your data on our behalf as our sub-processors. We currently use the following AI model providers:
Used for general reasoning, summarization, drafting, classification, and multi-step task execution triggered from the extension. Requests are sent to Anthropic's API under a commercial agreement and its applicable data processing terms. Anthropic does not use API request data to train its models.
anthropic.com/legal/privacyUsed for certain reasoning and task-execution workloads within the extension, as an alternative or supplemental model provider depending on the feature in use, user settings, or routing and reliability considerations. Data sent to DeepSeek is subject to the same contractual data-handling restrictions as data sent to Anthropic.
deepseek.com/privacyThe choice of which provider handles a specific request may depend on: the feature you are using; your settings or model preferences; internal routing logic; or real-time availability and reliability considerations. The same protections described in this Privacy Policy apply regardless of which provider handles a given request.
We may add, remove, or change AI model providers as the Services evolve. Where such a change is material, we will update this section and notify you in accordance with Section 26.
The following rules govern how both Anthropic and DeepSeek handle data we transmit to them on your behalf:
In summary: whichever model handles your request — Anthropic's Claude or a DeepSeek model — it receives only what you explicitly submit for that request, is contractually prohibited from training on your data, and does not retain it beyond the periods described in this policy. Your password hash is never shared with any AI provider under any circumstances.
Where the General Data Protection Regulation (GDPR), the UK GDPR, or equivalent Swiss data protection law applies to the processing of your personal data, we rely on the following legal bases:
| Processing purpose | Legal basis | Explanation |
|---|---|---|
| Operating the extension; routing your prompts and files to Anthropic or DeepSeek; generating and delivering a response to you | Performance of a contract (Art. 6(1)(b) GDPR) | Processing is necessary to perform the Terms of Service you have agreed to, or to take steps at your request before entering into that contract. |
| Account creation and management; authentication via password hash comparison | Performance of a contract (Art. 6(1)(b) GDPR) | Necessary to create and maintain your account and provide you with access to the Services you have signed up for. |
| Technical diagnostics, bug monitoring, fraud prevention, and security | Legitimate interests (Art. 6(1)(f) GDPR) | We have a legitimate interest in maintaining the reliability, stability, integrity, and security of the Services. This processing is proportionate and does not override your rights and interests. |
| Sending marketing or product update emails | Consent (Art. 6(1)(a) GDPR) | We send promotional communications only with your prior consent, which you may withdraw at any time by clicking the unsubscribe link in any such email or by contacting us. |
| Complying with legal obligations; responding to lawful authority requests | Legal obligation (Art. 6(1)(c) GDPR) | Processing is necessary to comply with our legal obligations under applicable law. |
| Business transfers (mergers, acquisitions) | Legitimate interests (Art. 6(1)(f) GDPR) | We have a legitimate interest in being able to structure, reorganize, or transfer our business, subject to the safeguards described in Section 15.6. |
The Services use AI models (described in Section 10) to generate responses to your prompts. These AI-generated outputs are tools to assist you in completing tasks; they do not constitute automated decisions that produce legal effects or similarly significant effects concerning you.
We do not use your personal data to make decisions about you that produce legal or similarly significant effects through automated means without human review. If this changes in the future, we will update this section and notify you accordingly.
The Services are not directed to, and are not intended for use by, individuals under the age of 13 (or the minimum age required in your jurisdiction to consent to data processing without parental approval, which may be higher — for example, 16 in certain EEA member states).
We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child below the applicable minimum age, we will take immediate steps to delete that data. If you believe a child has provided us with personal data, please contact us at support.coworker@gmail.com and we will investigate and act promptly.
We do not sell, rent, or license your personal data. We share data only with the recipients described below and only to the extent strictly necessary for the purpose stated. Every recipient category is listed; there are no other parties with whom we share personal data.
Who: Anthropic, Inc. and DeepSeek. What is shared: the text of your prompt and any attached file or tab content you have submitted for a specific request. What is never shared: your password, password hash, email address, or authentication token. Why: to generate a response or carry out the action you requested. How: transmitted via encrypted HTTPS API calls under a commercial data processing agreement. Neither provider uses your data to train its models, in accordance with the terms of our agreements with them.
Who: Cloud infrastructure providers such as Amazon Web Services (AWS) or Google Cloud Platform (GCP). What is shared: prompt text and request metadata (as part of our backend processing), email addresses and password hashes (for account management), and technical and diagnostic logs. Why: to run our backend systems, store limited data in accordance with the retention schedule in Section 16, and deliver the Services. How: hosted under contracts that restrict these providers from using our data for any purpose other than providing cloud hosting services to us.
Who: Technical error-monitoring providers such as Sentry. What is shared: anonymized or pseudonymized crash reports and error traces, including limited technical context such as the extension version, browser type, and error message. Personally identifying information — including any credential-related data — is redacted from error reports wherever technically possible. Why: to identify, diagnose, and fix technical bugs.
Who: Email delivery service providers (for sending waitlist notifications and account emails) and, where applicable, customer support platforms. What is shared: your email address and the content of any support communication you initiate. Why: to deliver transactional emails and to manage support inquiries. How: under contracts that prohibit use of your data for purposes other than delivering the services to us.
Who: Law enforcement agencies, courts, regulatory authorities, or other public bodies. What is shared: only the data required by the specific legal request. Why and when: we may disclose data if required to do so by a valid legal obligation, court order, subpoena, or equivalent lawful process; or where we reasonably believe in good faith that disclosure is necessary to protect our legal rights, property, or safety or those of our Users or the public. We will make reasonable efforts to notify affected Users of such requests where legally permitted to do so.
If Coworker AI Inc. is involved in a merger, acquisition, restructuring, asset sale, financing, or insolvency proceeding, personal data may be transferred to the acquiring or surviving entity as part of that transaction. Where such a transfer occurs, we will endeavor to notify affected Users before the transfer takes place, and will require the receiving entity to adhere to a privacy policy that provides at least equivalent protections to this one.
We may share aggregate, anonymized, or de-identified data — from which individual users cannot reasonably be identified — with third parties for purposes such as industry research, trend analysis, or service improvement reporting. Such data is not personal data and is not subject to this Privacy Policy.
Complete summary: your data may reach Anthropic and DeepSeek (AI providers, prompt content only — never passwords or hashes), our cloud hosting provider, error-monitoring tools, and email/support platforms. It is never shared with advertising networks, data brokers, or any unrelated third party, and is never sold under any circumstances.
| Data category | Retention period | Deletion method |
|---|---|---|
| Password hash | Retained for the lifetime of your account. The plaintext password is never stored at any point. The hash is permanently deleted upon verified account deletion. | Deleted upon account deletion request; automatic deletion upon account expiry. |
| Attached files | Never stored on our servers. Processed in memory by Anthropic or DeepSeek for the duration of the specific request only, then discarded upon completion of inference. | Automatic — discarded in memory upon request completion; no deletion action required. |
| Prompt text | Up to 7 days after the request is processed, retained solely for service continuity and critical error debugging. Permanently and automatically deleted thereafter. | Automated scheduled deletion. |
| Active tab content submitted with a request | Same as prompt text: up to 7 days after processing, then permanently deleted. | Automated scheduled deletion. |
| Page interaction / form-entry data during task execution | Processed for the duration of the task only. Retained only as part of the associated request record, subject to the same 7-day maximum, then deleted. | Automated scheduled deletion. |
| Authentication token (device-side) | Stored locally on your device until you sign out or uninstall the extension. Server-side session records are retained only while your account is active. | Cleared automatically on sign-out or extension uninstall; server-side records deleted upon account deletion. |
| Extension preferences (device-side) | Stored locally on your device for as long as the extension is installed, or until you clear extension data via Chrome settings. | Cleared by uninstalling the extension or via chrome://extensions → "Clear extension data." |
| Technical and diagnostic logs | Up to 30 days from collection, then deleted or fully and irreversibly anonymized. | Automated scheduled deletion or anonymization. |
| Email address and account data | Retained for as long as you maintain an active account or waitlist entry. Deleted within 30 days of a valid account deletion request. | Upon request to support.coworker@gmail.com or automatic expiry of waitlist entry. |
| Support correspondence | Up to 2 years from the date of the last communication in a thread. | Manual deletion upon expiry of the retention period, or upon request. |
To delete data stored locally on your device by the extension (authentication token, preferences), uninstall the extension from Chrome by navigating to chrome://extensions and selecting "Remove." If Chrome prompts you, select "Clear extension data" to ensure all locally stored data is deleted.
To request deletion of your account and associated data held on our servers (including your email address, password hash, and any retained prompt text), contact us at support.coworker@gmail.com. We will verify your identity, process your request, and confirm deletion within 30 days of a valid, verified request.
Upon a verified deletion request, we will delete your email address, password hash, account data, and any retained prompt text associated with your account. We may retain certain data beyond your request where a legal obligation, unresolved dispute, or fraud prevention requirement requires it, and will notify you of any such retention.
Coworker AI is incorporated and operates in the United States. Our service providers, including Anthropic, DeepSeek, and our cloud hosting providers, may process data on servers located in the United States and, in some cases, in other countries. If you are accessing the Services from the European Economic Area (EEA), the United Kingdom, Switzerland, or another jurisdiction with data transfer restrictions, your personal data may be transferred to a country that does not provide the same level of legal protection as your home jurisdiction.
Where we transfer personal data out of the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of data protection, we rely on one or more of the following safeguards:
You may request information about the transfer mechanisms we use by contacting us at support.coworker@gmail.com.
We implement technical and organizational security measures appropriate to the nature and sensitivity of the data we process. These measures include:
No method of transmission over the internet or method of electronic storage is completely secure. While we take security seriously and implement the measures described above, we cannot guarantee the absolute security of your data.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
If you suspect your data may have been compromised, please contact us immediately at support.coworker@gmail.com.
Depending on the laws applicable in your jurisdiction, you may have some or all of the following rights with respect to your personal data.
The right to confirm whether we process personal data about you and, if so, to obtain a copy of it, along with information about how it is processed.
The right to request correction of inaccurate personal data we hold about you, or completion of incomplete personal data.
The right to request deletion of your personal data, subject to exceptions described in Section 16 (e.g., legal obligations or fraud prevention requirements).
The right to request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or the lawfulness of processing.
The right to object to processing of your personal data based on our legitimate interests. Where you object, we must cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
The right to receive personal data you have provided to us, in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where processing is based on your consent or a contract.
Where processing is based on your consent, the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Under certain US state privacy laws (including the CCPA), the right to opt out of the sale or sharing of your personal data. We do not sell or share personal data as defined under those laws.
If you are located in the EEA or UK, the right to lodge a complaint with your local data protection supervisory authority — for example, the CNIL (France), the ICO (UK), or the relevant authority in your member state.
To exercise any of the rights described in Section 21, please contact us at support.coworker@gmail.com. Please include sufficient information for us to identify you and the right(s) you wish to exercise.
We will verify your identity before acting on any request that involves personal data about you, to protect against unauthorized access or deletion of your data. We will respond within the timeframe required by applicable law and, in all cases, will acknowledge receipt of your request within 48 business hours.
We will not charge a fee for responding to your request unless the request is manifestly unfounded or excessive.
The Coworker AI Chrome extension does not use cookies. All persistent data required by the extension (authentication token, user preferences) is stored locally on your device using the chrome.storage.local API. This data is stored only on your device and is never transmitted to our servers except where explicitly required for authentication (the token only, not your preferences).
Our website uses only strictly necessary cookies required for the basic functionality and session security of the website. We do not use advertising or targeting cookies, third-party behavioural tracking cookies, social media tracking pixels, or analytics cookies that track individual users across sessions.
| Cookie name / type | Purpose | Duration |
|---|---|---|
| Session cookie (strictly necessary) | Maintains your session state while you browse our website; required for the site to function correctly. | Session — deleted when you close your browser. |
| CSRF protection cookie (strictly necessary) | Protects against Cross-Site Request Forgery attacks on any form submissions on our website. | Session or short-lived (typically 24 hours). |
Some browsers offer a "Do Not Track" (DNT) signal that instructs websites not to track user activity across sites. Our website does not currently alter its behaviour in response to DNT signals, because no universally accepted technical standard for interpreting these signals has been adopted across the industry.
Regardless of DNT signals, we do not use cross-site tracking technologies, advertising cookies, or behavioural profiling on our website or through our extension, as stated in Section 9 and Section 23.
Coworker AI strictly does not execute remote code. All JavaScript executed by the extension is bundled within the extension package as reviewed and distributed by the Chrome Web Store. Specifically:
We may update this Privacy Policy from time to time to reflect changes to the Services, additions or removals of AI model providers, changes to applicable law, or changes to our data practices.
Where changes are material — including any change to the AI providers named in Section 10, any new category of data collection, or any new category of data recipient — we will notify you through: (a) an in-extension notice displayed when you next use the extension; (b) a prominent notice on our website; or (c) an email to the address associated with your account, where you have provided one.
Your continued use of the Services after a revised policy becomes effective constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must discontinue use of the Services.
For any question, concern, or request relating to this Privacy Policy, or to exercise any of the rights described in Section 21, please contact us using the details below. We aim to acknowledge all privacy-related communications within 48 business hours.
| Channel | Details |
|---|---|
| Email (primary) | support.coworker@gmail.com |
| Response time | Acknowledgement within 48 business hours; substantive response within the timeframe required by applicable law (typically 30 days under GDPR; 45 days under CCPA) |
| Supervisory authority (EEA/UK) | If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. The UK's supervisory authority is the ICO (ico.org.uk). |
Privacy questions or data requests? Contact our team directly. We respond within 48 business hours and handle all data requests in accordance with applicable law — support.coworker@gmail.com