Coda

Coda for Chrome: privacy policy

Published at: https://skein-web.vercel.app/privacy/chrome.

Applies to the "Coda" extension in the Chrome Web Store, published by OpenEvidence Inc.

In short

The extension lets the Coda app on your computer, and the AI agents you run in it, use your Chrome. It sends what it reads only to that Coda app on the same computer. It sends nothing to OpenEvidence Inc. or anyone else, and it makes no internet requests of its own.

What the extension reads, and when

Only when one of your Coda agents asks:

  • the titles and addresses of your open tabs, all of them, when an agent asks for the list of tabs (so it can find the one you mean);
  • in the tab the agent is working in (one it opened, or one it was pointed to): the page's visible text, and details of its links, buttons and form fields (their labels and positions), so the agent can find what to click or type into;
  • a screenshot of that tab;
  • the sound of a tab, recorded only after you allow that tab (click the Coda button on it and press Allow recording this tab). Only that tab's audio is recorded, never your microphone, your screen or other apps. You keep hearing the tab while it records; Chrome shows the tab is being captured, the Coda button reads REC, and its popup's Stop recording ends it. Allowing ends when the tab closes or moves to another site.

It leaves out the values of password fields, and of form fields the agent didn't type into itself. It replaces text that looks like a key or token (in page text, titles and addresses) with [redacted]. A screenshot shows the page as it is on screen.

It doesn't read your cookies, and it reads nothing in the background: there's no reading or acting unless an agent asks.

What it does on your behalf

When an agent asks, it opens, switches, reloads and closes tabs, goes back and forward, and clicks, types and scrolls in the tab it's working in. It can issue a fixed request from a focused tab to that site's own origin with Chrome's existing session cookies; only the HTTP status and a redacted address return to Coda, never the response body, response headers or cookies. Changing state with that request is off unless you, the operator, explicitly set exact website origins in Coda; agents cannot add origins. An allowed origin does not distinguish accounts that share its cookies. Chrome shows its "started debugging this browser" bar while it does. Pressing Cancel on that bar stops agents in those tabs until you allow them again in the extension's popup. (If your organization installed the extension for you, Chrome doesn't show that bar, and turning Chrome control off in Coda is how you stop agents.)

Where the information goes

  1. To the Coda app on your computer, through Chrome's native messaging, which connects the extension to a program on the same computer. Nothing goes over the network on the way.
  2. Kept by the Coda app in its data folder on your computer (normally ~/.skein), as part of the record of what your agents did.
  3. Sent to the AI model service you set up in Coda (for example Anthropic or OpenAI), because your agents work by sending their context to that service. That service's terms and privacy policy apply to what it receives. You choose the service and hold the account with it. OpenEvidence Inc. doesn't receive this data.

The extension itself stores only which tabs belong to which agent, which tabs you stopped and which you allowed to be recorded, while Chrome is open (Chrome's session storage). It stores no page content. A recording is held in the extension's memory until it is handed to the Coda app, and dropped if it isn't within 30 minutes of ending; Coda saves it as a file in its data folder.

What we don't do

OpenEvidence Inc. doesn't collect, receive, sell or share any data through this extension. The extension has no analytics, no tracking and no account. It runs no code downloaded from the internet: agents can send only a fixed set of actions (open, read, click, type, scroll, screenshot, same-origin request, record an allowed tab's audio), never scripts.

Turning it off and removing it

  • In Coda: Settings → Apps & tools → Let agents use your Chrome → Turn off. Agents can no longer use Chrome.
  • In Chrome: remove "Coda" from chrome://extensions, or right-click its toolbar button and choose Remove from Chrome.
  • What Coda already recorded stays in its data folder on your computer until you delete it.

Changes and contact

If this policy changes, the new version is published at this address before the extension version it describes. Questions: write to the contact email on the extension's Chrome Web Store page.