What Leaves Your Browser? A 90-Second Privacy Checklist for AI Browser Agents

P.S. If you want more privacy-first AI workflows like this one delivered to your inbox every week, join builders getting them free: https://wuki.beehiiv.com

Every AI agent product now claims "we store less." Claims are cheap — anyone can type that sentence into a landing page. The only version that works is the one a skeptical user can check in about 90 seconds. Here is the checklist I use, plus what my own browser agent looks like under it.

The 90-second checklist

1. Open the network tab. Load your agent, ask it one question, and filter the requests. What domains did it hit? If every action routes through one API you can inspect, you can see what it sends. If it phones home to five analytics domains you've never heard of, that's your answer.

2. Read the permissions screen. Browser extensions ask for specific permissions for a reason — the Chrome Web Store shows them verbatim. storage, tabs, scripting are normal for an assistant. history or blanket webRequest on everything is a different conversation.

3. Find one checkable, specific promise. "We care about privacy" is nothing. "Server-side we store: message IDs, token counts, error codes. Nothing else" is something you can audit. If a product can't state its retention in one sentence, that sentence doesn't exist.

4. Test the kill-switch. Disconnect the account, clear the extension's data, uninstall it. Then try to recover your conversation history. With zero-retention you get nothing back — which is the point, and it's the one demo that can't be faked.

What my agent looks like under that checklist

I built SideKik, a Chrome extension that lets you chat with any page and act on it. After an AI agent posted a CEO's bank balance to Slack, I decided the only defensible posture was to make trust checkable instead of promised. So here is the honest version:

• What leaves your browser: your prompt text, sent to the model provider to generate a reply. That's inherent to using an LLM — I won't pretend otherwise.
• What's stored server-side: message IDs, token counts, and error types. Nothing else. No prompt text, no page content, no conversation history.
• What's kept locally: enough context for the session you're in — and nothing survives a browser data clear.
• The debug tradeoff: no retention means no beautiful usage dashboards. You get logs of IDs, sizes, and error types, which turns out to be enough to debug with. You trade analytics for auditability, on purpose.

The network-tab test is the strongest piece: the "trust me" claim becomes "check me." Open DevTools, ask it anything, and the request payloads show exactly what I said above.

The honest limits

Zero-retention is not a magic wand. The model provider still sees the text you send — that's physics, and any product that claims otherwise is lying. What zero-retention buys you is a smaller blast radius: if I get breached, there is no conversation history to leak, which is the difference between "a CEO's bank balance went to Slack" and "a random token ID went to a log file."

What would you add?

This checklist catches the big stuff but a browser agent does many small things. What's the one check you'd run before trusting an AI agent with your browser? I'm genuinely collecting these — the page I'm building from this thread will be updated with every good answer.

Built with SideKik — chat with any page, act on it, remember nothing.