SuperSurf Privacy Policy

Effective date: February 21, 2026

What SuperSurf Does

SuperSurf is a browser automation extension that connects your Chrome browser to a locally-running MCP (Model Context Protocol) server. It enables AI coding assistants to interact with web pages for development and testing purposes.

Data Collection

SuperSurf collects no data. Specifically:

• No personal information is collected
• No browsing history is recorded or transmitted
• No cookies, passwords, or form data are accessed by the extension itself
• No analytics or telemetry of any kind is sent anywhere
• No user behavior is tracked

Network Communication

SuperSurf communicates exclusively over a localhost WebSocket connection (ws://127.0.0.1) to an MCP server running on your own machine. No data ever leaves your computer through the extension.

• The WebSocket connection is bound to 127.0.0.1 (loopback only)
• No external servers, APIs, or cloud services are contacted
• No data is transmitted over the internet

Local Storage

SuperSurf uses Chrome's built-in storage APIs for operational state only:

• chrome.storage.local — Stores extension preferences (enabled/disabled state, debug mode flag, WebSocket port, domain whitelist cache)
• chrome.storage.session — Stores ephemeral automation state (which tab is being controlled, cursor positions) that is automatically cleared when the browser closes

No personal data, credentials, or browsing content is stored.

Permissions

SuperSurf requests browser permissions necessary for automation functionality. Each permission is used strictly for its documented purpose:

• debugger — Attaches Chrome DevTools Protocol for screenshots, network inspection, and JavaScript evaluation on the active automation tab
• tabs — Creates, navigates, and manages browser tabs during automation
• activeTab — Accesses the currently active tab when the user interacts with the extension
• scripting — Injects content scripts for DOM interaction and page state capture
• storage — Persists extension preferences and ephemeral session state locally
• alarms — Maintains WebSocket connection keepalive and schedules reconnection attempts
• webRequest — Monitors network requests on the automation tab for debugging purposes
• webNavigation — Enforces optional domain whitelist restrictions on navigation
• tabGroups — Organizes automation tabs into visual groups for multi-session workflows
• downloads — Downloads files when requested by the automation agent

Credential Handling

SuperSurf includes a secure credential fill feature. When used, credential values are resolved from local environment variables on your machine by the MCP server process. The AI agent never sees the raw credential values. Credentials are typed character-by-character into form fields and are not stored or logged by the extension.

Third-Party Services

SuperSurf does not integrate with any third-party services, advertising networks, or data brokers. The optional domain whitelist feature fetches the Tranco top-sites list from a public URL for safety enforcement, but no user data is sent in this request.

Open Source

SuperSurf is open source. The complete source code is available for inspection at github.com/liquidbuiltit/supersurf.

Changes to This Policy

If this privacy policy changes, the updated version will be published alongside the extension update. Material changes will be noted in the extension's changelog.

Contact

For questions about this privacy policy, open an issue on the GitHub repository.