Privacy

Last updated 28 October 2026

Vicaro is a self-hosted browser assistant. It runs on your computer. There is no Vicaro account, no Vicaro server, and no telemetry.

What Vicaro is

Vicaro has two parts: a Chrome extension that reads the page you are on and performs the click or keystroke an assistant asks for, and a helper program you install and run yourself, which decides what to do, talks to the model you configure, and stores its data locally. They talk over a loopback connection, or over your local network if you explicitly configure split mode with a bearer token.

What the extension can see

Only what it needs to carry out a request you make: the list of open tabs (titles and addresses), the visible content and interactive elements of a tab once you have granted page access to that site, the action it is asked to perform, and the page state afterwards.

It does not read pages in the background, and it does not run on sites you have not granted. Nothing is sent anywhere except to your own helper.

Optional capabilities

Two capabilities are off until you enable them in Settings, Access:

• Deep control (CDP) uses Chrome's debugger attachment for trusted input, screenshots, DevTools inspection and file upload. Without it, Vicaro still clicks and types through the page itself.
• History and closed tabs lets the assistant search your browsing history and reopen a closed tab, only when you ask it to.

Both can be removed at any time from Chrome's extension settings.

Where your data goes

• Your model endpoint. Messages, page text and tool results are sent to the model server you configure — a local server, your LAN, or a hosted provider. That server's privacy policy applies to it. Vicaro has no default provider and no fallback.
• Nowhere else. No analytics, no crash reporting, no usage statistics, no advertising identifiers, and no sale or sharing of data with third parties.

What is stored, and where

• On your machine: conversation history, task state, memories, saved skills and the secret vault live in a SQLite database owned by the helper, in the app's data directory.
• In Chrome: the panel stores your helper address, bearer token, theme and model preference in chrome.storage.local.
• Secret vault values are substituted into actions at execution time and never sent to the model.

Your controls

• Revoke page access or the optional permissions in chrome://extensions, or in Settings, Access.
• Delete the helper's database file to erase history, tasks and memories.
• Uninstall the extension and the helper to remove everything.

Children

Vicaro is a developer tool and is not directed at children under 13.

Changes

If this policy changes, the updated version ships with the next release and is dated above.

Contact

Questions about this policy: hello@creativeducks.com.