Last updated: September 20, 2026
Remote Tab is a Chrome extension published by BeanOS AI LLC (“BeanOS,” “we,” “us”). It lets you share one browser tab with an AI agent, so the agent can see that tab and — in the modes you allow — act in it. You choose the tab, the mode, the site scope, and when sharing stops.
The single most important fact in this policy: what the agent sees in your tab is end-to-end encrypted, and the relay server cannot read it. Section 4 explains exactly why, in enough detail that you can check the claim against the source rather than take our word for it.
The extension does nothing until you act. Nothing is captured, and no connection to a relay is made on your behalf, until you paste a one-time rt1. code into the extension popup, choose a mode, and click Share this tab. Before that point the popup reads only the current tab's title and URL, so it can show you what you are about to share; that never leaves your browser.
Only the single tab you chose is shared — never your other tabs, never your browsing history, never your whole browser. A share ends when you click Stop, when you close the shared tab, or when it expires on its own. Shares are short by construction: 30 minutes by default and one hour at the absolute maximum. Pause suspends capture at any moment without ending the share.
- Read-only — the agent can see the tab. It cannot act in it.
- Act — the agent can additionally click, type, and navigate within your site scope.
- Full — adds scripting and network/console diagnostics.
This site only restricts the whole share to the site you started on. Password, one-time-code, and payment fields are masked. If the tab presents one of those fields, or embedded content the extension cannot inspect, scripting and diagnostics are disabled for the remainder of that share — including in Full mode, and even after you navigate away. That latch only ever tightens; it never re-opens mid-share.
While a share is active, and only for the tab you shared, the extension may capture and transmit:
- The shared tab's page content — visible text, page structure, and screenshots of that tab.
- The shared tab's URL and title, including as it navigates while shared.
- Results of the agent's actions in the modes you allowed (for example, what happened after a click).
- In Full mode only, and only while diagnostics remain enabled: the tab's network activity metadata and console output. Credential-bearing headers are redacted before they leave your browser.
The extension requests three Chrome permissions, each for one reason: tabs, to identify the tab you picked and show you its URL; debugger, which is how it reads the page and performs the actions you enabled — Chrome displays its own “Remote Tab is debugging this browser” banner the entire time; and notifications, to tell you when the agent is waiting on you or the share's state changed. It requests access to exactly one host: the relay it is built to trust.
Every message between your browser and the agent is encrypted with AES-256-GCM before it leaves the extension, and decrypted only at the other endpoint. The key is derived with HKDF-SHA256 from the random secret carried inside the rt1. code you pasted.
That secret is never sent to the relay. The relay addresses your session by an identifier that is a one-way hash of the secret, so it can route your messages without ever being able to derive the key. What the relay holds for a session is: ciphertext, a nonce, a hash chain linking the messages in order, timestamps, and hashes of the two session tokens — never plaintext, and never the tokens themselves. This is why the code is a code you paste and deliberately not a clickable link: a link would hand the secret to a web page.
Be precise about what this does and does not prove. It proves that the relay cannot read your shared-tab content and could not produce it if asked, and that BeanOS cannot recover a share for you if you lose the code.
It proves nothing about the other end. Your agent decrypts the content — that is the entire point of the share. If the agent you are sharing with is operated by BeanOS, then a BeanOS system holds that plaintext while it works, under the agreement between us and our Terms of Use. If you are sharing with an agent you run yourself, or one operated by someone else, that operator receives the plaintext and handles it under their policies, not ours. The encryption protects the path; it cannot protect you from the party you deliberately chose to show your tab to.
Encrypted messages go to one relay and nowhere else. The official build of Remote Tab published by BeanOS trusts tab.beanos.ai and nothing else — that single host is the extension's only declared host permission, so it is enforced by Chrome, not merely promised here. The extension contacts no analytics service, no advertising network, and no other BeanOS endpoint.
Remote Tab is open source, and the relay is the security boundary. If you would rather not place that trust in us, you can run your own relay and load your own build of the extension pointed at it. Then no BeanOS server is in the path at all. Both paths run the same code.
Session records. For each share, tab.beanos.ai stores the encrypted messages described in section 4, plus the share's creation and expiry times, its state, and the IP address of the client that created it. These are deleted automatically: expiry is at most one hour after creation, and the record carries a deletion timestamp of roughly one day after the share expires.
Usage records. Separately, the relay reports usage counts to keys.beanos.ai so it can meter and rate-limit the free service. Each record holds an event kind (a share was created, a message passed, blob bytes transferred, or a request was throttled), a count, a timestamp, the tier, and one identifier: your API key's subject if you used a key, or your IP address if you did not. It contains no message content. These records are retained for seven days — longer than the session records above, and the honest reason to call them out separately.
So your IP address is used for two things, not one: limiting how many shares a single source runs at once, and usage metering when you are not using a key. Using a key means the usage record carries the key's subject instead of your IP.
The hosted relay at tab.beanos.ai issues API keys through keys.beanos.ai to set request rate limits. A key's raw value is shown to you once and never stored — only a SHA-256 hash of it is kept, which is enough to recognise your key but not to reconstruct it.
You may optionally verify an email address to move a key to a higher rate tier. Be aware of when it is stored: the address is written to your key record as soon as you submit it, before the verification code is sent — not once you complete verification. If the code never arrives, or you simply abandon the step, that submitted address stays on the key record until the key is deleted. If you never submit an address, we hold no email address for you at all.
An address you do give us is used for verification and for service notices about your key. It is not used for marketing, not sold, and not shared.
The extension requests no storage permission and writes no share state to disk. The active share — including its key — is held in memory only, for as long as the share lasts. If the browser or the extension's worker restarts, that state is gone: the share cannot be resumed, and starting again requires a new code and your consent afresh.
The interaction summary — the reviewable record of what the agent did — is likewise held for the share and, because it is the record you read, it contains decrypted page data. It leaves your device only if you deliberately export it. Treat an exported summary as you would a screenshot of the tab.
- No advertising, no analytics, and no tracking of any kind in the extension.
- No sale of your data, and no transfer to third parties.
- No use of your data for purposes unrelated to the share you started, including no use for creditworthiness or lending decisions.
- No reading of tabs you did not share, and no collection of browsing history. The shared tab's own URL and title are transmitted while you share it, as disclosed in section 3.
- No training of models on your shared-tab content. For the relay this is structural, not merely promised — it never holds the key (section 4). For a BeanOS-operated agent, which does see plaintext, it is a commitment we are making to you, and you should read it as one.
Field masking and the diagnostics latch reduce the risk of exposing secrets, but they are a safety net, not a guarantee. Do not share a tab that is displaying passwords, one-time codes, or payment card entry, and do not send credentials to an agent through a share. Agents using Remote Tab are instructed to request the least capable mode that does the job, to hand control back to you rather than act on your behalf at a login or confirmation step, and never to attempt to bypass your site scope or the masking.
Remote Tab is a developer tool and is not directed to children. We do not knowingly collect personal information from anyone under 13.
We may update this policy as Remote Tab evolves; the “Last updated” date reflects the current version. Material changes will be reflected here before they take effect in a published build.
Questions about this policy: legal@beanos.ai. Bug reports and feature requests: website.query@beanos.ai.