Browser Extension Privacy Policy
Effective date: 26 October 2026
Applies to: the VeloPhex Browser Automation extension for Google Chrome and Microsoft Edge, version 0.7.7 and later.
What the extension is
The VeloPhex extension connects the browser to the VeloPhex automation software installed on the same computer (VeloPhex Studio, used by a person to build automations, and the VeloPhex Robot, which runs them). It does nothing on its own: it is a bridge between pages you have open and the VeloPhex software, through the VeloPhex Browser Host, a small program the VeloPhex installer places on the computer. Without that host the extension shows "not connected" and passes nothing on.
What it reads
When a VeloPhex automation or a person using VeloPhex Studio is working with a page, the extension reads, from that page and only when asked:
- the structure of the page: elements, their roles, names, labels, positions and their markup attributes, so a person building an automation can choose which of them identify an element. Left out:
style, event handlers (on…) and a password field'svalue; at most 32 attributes per element, each cut at 256 characters. When a person inspects one element in Studio's UI Explorer, that element's attributes are read in full (at most 64, each cut at 1,024 characters), still never a password field'svalue; - text shown on the page, and the current value of form fields, except password fields, whose values are always refused;
- the addresses (URLs) and titles of the tabs and windows in the profile the extension is installed in, so an automation can find the tab it was built for. Private windows you opened yourself are left out of that list;
- a picture of the visible part of a tab, when an automation asks for a screenshot or a person captures one in Studio;
- when an automation step reads browser data ("Get Browser Data"): the cookies the browser would send to the page in that tab (names, values including cookies the page's own scripts cannot see, domain, path, flags and expiry) and the page's local and session storage. Cookies are read from that tab's own cookie store; the extension never reads the cookies of any other site;
- when an automation step waits for a download: the next entry of the browser's download list after the step began waiting (its file name and location on the computer, its size, its state and the address it came from, origin and path only, never the query string). Downloads made in private windows are ignored. The extension only reads the list; it never starts, opens, moves or deletes a download.
It also notices when a page an automation is attached to opens a JavaScript alert, confirm or prompt dialog, because such a dialog freezes the page and the automation would otherwise wait in vain. To do that, a small part of the extension runs inside every page and wraps the page's alert, confirm and prompt functions. The dialog still opens and works exactly as before, and the extension never answers it. On a tab no automation is attached to, nothing about the dialog leaves the page. On an attached tab, the dialog's type and message are kept in the extension's memory only while the dialog is open, and are passed to the VeloPhex software only if the automation calls that tab while the dialog is open; the automation then stops with a message that names the dialog.
What it changes
Only when an automation step asks, and only in the tab that step is working on:
- it clicks, types, selects, scrolls and fills in the page as the step says, and puts files the VeloPhex software sends on the page's upload field, as choosing them in the file dialog would;
- it sets or removes cookies of the page in that tab, and sets, removes or clears its local or session storage ("Set Browser Data"), typically to restore a signed-in session saved by an earlier run;
- it opens, navigates, reloads, activates and closes tabs, and maximizes, minimizes, moves, resizes or closes their window;
- it shows a small "VeloPhex automation active" indicator in the bottom-right corner of a page an automation is attached to.
Private (Incognito / InPrivate) windows
The browser keeps the extension out of private windows unless you switch on Allow in Incognito (Chrome) or Allow in InPrivate (Edge) for it; that switch is off by default. Even when it is on, the extension automates only the private windows it opened itself for an automation that asked for one. A private window you opened yourself is never listed to, read by or changed for the VeloPhex software: every request that names one of its tabs is refused. Cookies in a private window the extension opened come from that window's own cookie store, which the browser discards when the window closes. The extension remembers which private windows it opened only until the browser closes.
Once you allow the extension into private windows, the browser runs its page scripts there too, but an automation can never attach to a tab of a private window you opened, so nothing about a dialog there leaves the page.
It reads nothing from browser pages (chrome://, edge://, the stores), where the browser does not run extensions.
Where it goes
Everything the extension reads is passed to the VeloPhex Browser Host on the same computer, over the browser's native messaging channel, and from there to the VeloPhex Studio or Robot process that asked for it. The extension makes no network requests and sends nothing to VeloPhex or to any third party. It has no analytics and no telemetry. The only code it runs that it does not ship is the expression of an "Execute JavaScript" automation step, which the automation's author wrote, which their project must explicitly allow, and which reaches the extension from the VeloPhex software on the same computer; it runs in the page under the page's own security policy, and its result goes back the same local way.
The only things the extension stores in the browser are one random identifier for the profile it is installed in (chrome.storage.local), so the VeloPhex software can tell two profiles of the same browser apart, and, until the browser closes, the ids of the private windows it opened (chrome.storage.session). It stores no page content, no cookies, no history and no credentials.
What VeloPhex Studio and the Robot may keep
The extension itself keeps nothing. The VeloPhex software it feeds may, on the same computer and under the control of the person or organisation running it:
- write run logs that name the pages an automation visited (address and title) and what each step did, never the text that was typed into a field, and for browser data only how many cookies or storage items were read or set, never their names or values. A step stopped by a JavaScript dialog logs the dialog's message;
- hand the cookies and storage a "Get Browser Data" step read to the automation, which the automation's author decides what to do with (typically to restore them in a later run);
- save a screenshot of the page when a step could not find its element, if the project's settings allow it; by default this happens only where a person is at the computer, never on an unattended robot, and the newest twenty are kept;
- keep, inside an automation project a person builds in Studio, the element descriptions and page images captured at design time, which the person can inspect and remove.
Those files belong to the person or organisation running VeloPhex, stay on their computers, and are governed by their own policies. VeloPhex (the company) receives none of them.
Who is responsible
The person or organisation that installs and runs VeloPhex decides which pages are automated and what is done with what is read; they are the data controller for that data. VeloPhex, as the maker of the software, does not receive, process or store any of it.
Limited Use
The use of information received from this extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Changes
We will update this page when the extension's behaviour changes, and the extension's version number will change with it. The effective date above is the date of the current text.
Contact
Privacy questions about the extension: support@velophex.com. See also the extension's product page and the velophex.com privacy policy.