Who this covers
This policy describes how the Web2MCP browser extension (the “Extension”) handles data. It does not cover the third-party websites you visit, which are governed by their own privacy policies.
What the Extension processes
To turn a site's APIs into callable tools, the Extension observes the network requests a page makes while you browse it. This can include:
- Request URLs, methods, and query parameters;
- Request headers (including authentication headers such as
authorization) and, for JSON requests, request bodies; - Response status codes and JSON response bodies (sample responses are kept to infer the shape of each endpoint);
- The domain of the page you are on, used to group recordings by website.
The Extension only inspects JSON API traffic and deliberately ignores static assets and known analytics/tracking requests.
Where this data is stored
All of the above is stored locally in your browser using the browser's storage.local API, on your device only. It is used solely to register WebMCP tools for the sites you visit and to display them in the Extension's popup.
What the Extension does NOT do
- It does not transmit your data to us, to our servers, or to any third party — the Extension has no backend and makes no analytics or telemetry calls.
- It does not require an account or collect any identity, contact, or payment information.
- It does not sell or share your data, and does not use it for advertising, profiling, or creditworthiness.
- It does not execute remote code; all of its logic ships inside the extension package.
Requests the Extension makes
When you (or an AI agent in your browser) invoke a recorded tool, the Extension replays that request to the site's own API endpoint from your browser, using your existing session — exactly as the website itself would. These requests go only to the endpoints recorded from the site you are using; the Extension does not send data to any destination of its own.
Permissions and why they are used
storage/unlimitedStorage— save recorded endpoints and per-site settings locally.tabs— read the active tab's URL to group recordings by site and show the per-tab tool count on the toolbar badge.- Access to the pages you visit (content scripts) — record and inject tools on whichever site you are actively using. The Extension is not tied to specific sites and reads no browsing history.
Sensitive data
Because the Extension records request headers, locally stored data can include authentication tokens for the sites you visit. This never leaves your device. If you are concerned about a particular site, you can disable injection for it or clear its recorded data at any time from the popup (see below).
Your controls
- Disable injection per site — turn tool injection off for any site from the popup; you can re-enable it anytime.
- Clear a site's data — remove all recorded endpoints for a site with one click.
- Uninstall — removing the Extension deletes all of its locally stored data.
Data retention
Recorded data remains in your browser's local storage until you clear a site, uninstall the Extension, or clear your browser data. We hold nothing, because nothing is ever sent to us.
Children
The Extension is a developer tool and is not directed to children under 13.
Changes to this policy
If this policy changes, the “Last updated” date above will change and the current version will always be available at this URL.
Contact
Questions about this policy? Contact i@joway.io.
Web2MCP is an open-source, local-only browser extension. It is not affiliated with any website it records.