Privacy Policy — nanobots
Applies to the nanobots browser extension and the nanobots-sh command-line tool. Last updated 2 August 2026.
We run no servers and receive none of your data. nanobots has no backend. Everything it does happens in your browser or on your own machine, and every network request goes directly from you to a service you configured with your own credentials. There is no account to create, no telemetry, and no analytics.
What the extension stores, and where
All configuration is kept in your browser's local extension storage. It never leaves your device except to reach the service it belongs to.
- GitHub personal access tokens and the list of repositories you can file to.
- Cloudflare R2 credentials — account id, bucket, API token, and public base URL.
- Model provider settings — the endpoint, model name, and API key you choose, including a separate vision model if you configure one.
- A local history of reports you have filed, so you can find them again.
What is transmitted, and to whom
Only when you take an action, and only to the service that action is for:
| Destination | What is sent | When |
|---|---|---|
GitHubapi.github.com |
Your token, the issue title and body, the page URL and title of the page you are reporting about, and search queries when the assistant looks for existing issues or code. | When you file a report or ask the assistant about the repository. |
Cloudflare R2api.cloudflare.com |
Your R2 API token and the annotated screenshot image. | When you file a report with a screenshot attached. |
| Your model provider (the endpoint you choose) |
Your API key, the messages you type, and any screenshots you attach to the chat. | When you send a message in the assistant chat. |
These are your accounts, reached with your credentials. Their handling of that data is governed by their own privacy policies, not this one.
Screenshots
A screenshot is captured only when you click the extension's toolbar icon. Nothing is captured in the background, on a schedule, or without that click. The image is shown to you for annotation before anything is sent, and you can cancel at any point. If you have not configured R2, reports are filed as text only and no image is uploaded.
What we do not do
- We do not operate a server, so we cannot and do not receive your data.
- We do not sell or transfer your data to anyone.
- We do not use analytics, tracking pixels, fingerprinting, or advertising identifiers.
- We do not monitor your browsing, log keystrokes, or record activity on pages you visit.
- We do not use your data to determine creditworthiness or for lending purposes.
- We do not use your data for any purpose beyond the extension's single purpose: capturing, annotating, and filing a report to a repository you chose.
Permissions, and why each exists
activeTab— to capture the current page and draw the annotation layer on it, only after you click the toolbar icon.scripting— to inject that annotation layer into the page you are reporting about.storage— to keep your settings and report history locally.- Host permissions — a fixed list: GitHub, Cloudflare, and the supported model
providers. The extension does not request access to every site you visit. A local model server on
localhostcan be granted separately, only if you configure one.
Deleting your data
Removing the extension deletes everything it stored, because everything it stored was local. Issues you filed live in your GitHub repository and screenshots live in your R2 bucket; both are yours to delete directly.
Children
nanobots is a developer tool and is not directed at children under 13.
Changes
If this policy changes materially, the updated version will be published at this URL with a new date above. The extension's Chrome Web Store listing links here.
Contact
Questions or requests: open an issue at github.com/TimHeckel/nanobots/issues.