Privacy

What we collect, and what we don't

Last updated August 2026

War Machine is an AI operator for marketing work. This page explains what the product and the War Machine Operator browser extension do with your data. It is written to be read, not to cover us.

The browser extension

The extension exists so War Machine can act inside tools you are already signed into — in your browser, using your sessions — instead of asking you to sign in again somewhere else.

Because of that, the important part is what it does not do:

• It stores nothing. No cookies, no passwords, no session tokens, no page contents. It keeps a single id in memory for the tab it is driving, and that is discarded when the browser closes.
• It never sends your credentials anywhere. Your logins live in your browser, where they already were. The extension cannot read them and does not try to.
• It only carries out the moves you ask for. To decide the next move, the War Machine page sends our server a description of the page currently on screen — its address, title and visible text — and, when placing a finished deliverable, only that deliverable's name and length. The deliverable's contents never leave your browser. The model decides one step; your browser performs it.
• Nothing consequential happens without you. Anything that looks like publishing, sending or deleting stops and asks for your say-so first, judged on the real words of the control involved.

The extension requests broad site access because the whole point is to operate whichever tool you name — your inbox, your CRM, your CMS. That access is used only to carry out a task you started, in a tab you can see, and never to browse or collect on its own.

Which means the honest version of “visible text” is: whatever is on screen. Point the operator at your inbox and the message you have open is part of what gets read; point it at your CRM and a contact's details are. That is what our Chrome Web Store listing declares as collected — website content, personal communications, personal details — because declaring only the first would be true of the mechanism and misleading about the use. It is read to decide the next step of the task you started. It is not stored: the page description lives in that one request and the step log records what was done, never the page.

Deciding a step means a model reads that description. Ours is Claude, run through Anthropic's API under terms that forbid training on it. No other company sees the page.

Your account

To run the product we store your email, the profile you give us (your role, where your time goes, and your website), and the record of your days — the briefs proposed, the missions you ran, and their output. This lives in our database (Supabase) and is protected so that only you can read your own rows.

What the product reads for you

War Machine reads public web pages to ground its work — your own site's sitemap, a competitor's pricing page, a search result. It reads what is public, and for anything behind a login it drives a browser you are signed into rather than storing a key to it. We do not connect to your accounts through third-party APIs.

Payments

Subscriptions are handled by Stripe. Your card details go to Stripe, not to us — we store only the plan you are on and the identifiers Stripe gives us to manage it.

What we never do

• We do not sell your data, and we do not share it for advertising.
• We do not train models on your private work.
• We do not compile a profile of you from across the web, and the extension does not track your browsing.

Keeping and deleting it

We keep your account data while your account exists. Ask us to delete it and we will remove your profile, missions and messages. Uninstalling the extension removes it and everything it held completely, since it held nothing beyond the current session anyway.

Contact

Questions, or a deletion request: echo@warmachine.io.