What Arrows Lite Sends to AI — and What It Never Sends
Straight answer: when you press the AI page summary button, Arrows Lite sends exactly three things — the title of the tab you are saving, the visible text of that page (capped at 6,000 characters), and the language you want the summary in. It never sends your URL, images, cookies, passwords, form values, hidden elements, sticky notes, or Saved Cases.
This page is not a marketing pledge. It is written from the extension’s implementation — the code that builds the request and the code that extracts page text. If the implementation changes, this page changes with it.
When anything is sent at all
Data leaves your browser only when you explicitly press the AI page summary button while saving. There is no background or scheduled sending. Only the one tab you are saving is read — never the contents of your other tabs or your history.
The “AI overview of a work group”, added in 1.1.4, also runs only when you press it. It sends the group name you typed and the <strong>titles</strong> of the tabs in that group, plus the output language — one request per group, however many tabs it holds. No page is opened or read to build it, and addresses, page contents, images, and cookies are not sent.
- The AI summary is optional. If you never use it, nothing is ever sent.
- You can edit or discard the drafted summary before saving, or skip AI and write your own note.
- Only the page you are looking at is read (main frame only — embedded iframes are not read).
What we send (three things)
The summary request contains exactly these three fields:
| What | Details | Notes |
|---|---|---|
| Page title | The title of the tab you are saving | Replaced with a safe default if empty; trimmed to 300 characters |
| Visible page text | The visible, non-input text of that page, normalized | Capped at 6,000 characters; everything in the “never sent” list below is excluded before extraction |
| Output language | One language code out of en / zh_CN / ja / es / de / fr / ko | Allow-list only — no free-form value is sent |
For authentication, your Google sign-in token is attached as a request header. The token is held in memory only — it is never written to storage on your device or on the server.
What we never send
The following data cannot be included — either the request has no field for it, or the extractor excludes it before anything is built:
| Never sent | Why — grounded in the implementation |
|---|---|
| URLs | The request has no URL field at all |
| Images, video, audio | img / svg / canvas / video / audio are excluded from extraction |
| Cookies | The extension has no cookies permission and cannot read them |
| Passwords | Input values (including password fields) are excluded from extraction |
| Form values | input / textarea / select / contenteditable content is excluded |
| Hidden elements | hidden / aria-hidden / display:none / visibility:hidden are excluded |
| Scripts and styles | script / style / noscript are excluded |
| Sticky Notes | Stored locally on your device; never part of the request |
| Saved Cases | Stored locally on your device; never part of the request |
| Settings | Only the single output-language code above is sent — no other setting |
| Browsing history, other tabs | No history permission; no page outside the target tab is read (a group overview sends tab titles only) |
Where it goes
The request is sent once over HTTPS to our own relay server (a Cloudflare Worker), which forwards it to the AI provider (Anthropic) and returns the summary. The result is stored only on your device.
- The relay is the only external server the extension can talk to — it has no <all_urls> host access.
- The relay enforces usage quotas and an emergency stop, so unexpected bulk sending is blocked server-side too.
- Page text, titles, and tokens are not written to server logs (only generalized messages are logged).
What is stored (all local)
Separately from the AI request, everything Arrows Lite stores lives inside your browser on your device. Nothing is synced to an external server.
| Data | Where | Contents |
|---|---|---|
| Saved Cases | Your device | Title, URL, note, AI summary, timestamps (the URL is kept so a case can reopen) |
| Sticky Notes | Your device | Note text, position, size. Pages are identified by a hash — the raw URL is not stored |
| Language setting | Your device | “Auto” or a single language |
- Uninstalling the extension removes the stored data.
- You can export and import Saved Cases as a JSON file for your own backup.
- The extension contains no analytics, tracking, or ad SDKs.
FAQ
No. Sending happens only when you press the AI page summary button. Without that action, Arrows Lite sends nothing externally.
URLs often contain sensitive parts such as IDs and tokens. A title plus visible text is enough to draft a summary, so the request simply has no URL field.
The drafted summary is shown before saving and you can edit or discard it. And because only visible text is eligible, what you can see on the page is the outer bound of what can be sent.
Google sign-in is required only for the AI page summary (to control usage). The core features — save, organize, resume — work without signing in.
This page is written from the request-building and text-extraction code, and is updated together with implementation changes. If you spot a mismatch, please contact us via the store listing.
Private by design — and built to resume your work
Because what gets sent is explicit and small, you can focus on saving and resuming your work. It installs in about a minute.
Get it on Chrome Web Store — Free