Security & Privacy

At Selfotix, we believe that powerful automation should not come at the expense of your privacy. Because our tool operates directly inside your browser to perform tasks, it requires access to the websites you visit. We take this responsibility seriously.

This document explains how we handle your data, why we require certain browser permissions, how we build our software securely, and what you can do to keep your automated tasks safe.

1. Where Your Data Lives (Zero Cloud Storage for Workflows)

Many automation tools send your web data to their own company servers to process it. We do exactly the opposite: the heavy lifting happens locally on your machine.

  • Zero Cloud Storage for Scraped Data: Your scraped data, the workflows you build, and the websites you target exist only on your personal device. We do not have a central database collecting your scraped information, and our team cannot see or access your automated tasks. All extracted data is saved directly to your browser’s secure, built-in IndexedDB storage.
  • Your API Keys: If you connect a third-party AI provider (like OpenRouter) using an API key, that key is saved only on your device. We never see your API keys, and we never read your AI prompts.
  • Subscription & Device Authentication: To enforce usage limits and verify premium licenses, our extension securely communicates with our authentication server (extension-api.selfotix.com). The only data transmitted is your account email, license key, randomized device ID, and your current credit usage count.

2. Our Security & Development Standards

To ensure the safety of our users, we follow strict software development protocols:

  • Chrome Web Store Approved: Our extension is peer-reviewed, verified, and officially approved by the Google Chrome Web Store review team to ensure it meets strict security, privacy, and performance guidelines.
  • Internal Peer Review: Every single update or new feature added to this extension undergoes rigorous internal review by our development team before being released to the public.
  • Tracked Changes: All updates to the software are strictly tracked and documented so we maintain a complete, transparent history of how the tool operates.

3. A Transparent Guide to Our Browser Permissions

To automate web tasks exactly like a human would (clicking, typing, reading, and scheduling), our extension needs permission to interact with your browser. Here is exactly what those permissions are and our strict boundaries for using them:

  • “Read and change all your data on the websites you visit” (Host Permissions & Scripting)
    • Why we need it: This is the engine of the automation. It allows the tool to inject necessary scripts to read text on the page, extract emails or technical stacks, and interact with the website (like clicking buttons).
    • Our Boundary: The extension only interacts with a webpage when you explicitly trigger a workflow or a scheduled bot activates. It does not passively monitor or record your browsing history.
  • “Access your tabs and browsing activity” (Tabs & Windows)
    • Why we need it: This allows the tool to run complex tasks—like opening new automation tabs, navigating through links, and splitting or resizing browser windows to manage simultaneous background bots without interrupting your workflow.
    • Our Boundary: We only manage the specific tabs and windows created or targeted by your active automation run.
  • “Alarms” (Background Scheduling)
    • Why we need it: This allows you to schedule workflows (e.g., daily scraping tasks). The alarms permission wakes up the extension in the background to execute your bot precisely when you tell it to.
  • “Side Panel”
    • Why we need it: This allows us to display the Selfotix user interface directly alongside your active webpage, making it easy to build and monitor workflows without constantly switching tabs.
  • “Read and modify your clipboard” (ClipboardRead / ClipboardWrite)
    • Why we need it: We offer “Copy” and “Paste” actions. To simulate pasting data into a tricky form field, the tool must temporarily place data into your clipboard and paste it.
    • Our Boundary: The tool will never read your clipboard unless a workflow specifically reaches a “Paste” step that you designed.
  • “Storage”
    • Why we need it: To save your workflow setups and scraped data directly to your browser’s local database.

4. The Golden Rule: Be Careful with Imported Workflows, Table Data, and Prompts

One of the best features of Selfotix is the ability to download and share workflow templates, table data, and custom prompts with others. However, you should treat these downloaded files like any other software you install on your computer.

If you download a workflow, table, or prompt from an untrusted source on the internet, please review its contents and steps before importing it and clicking “Run”:

  • Check the Destinations: A malicious workflow could include a hidden step designed to send the data you scrape to a stranger’s server via an API call. Always check the “Webhook URL” or network steps in the settings before running an imported bot to ensure your data is only going exactly where you want it to go.
  • Review Prompts and Data: If you import third-party custom prompts or table data, briefly read through them. Make sure they do not contain hidden instructions or malicious links designed to manipulate your automated tasks or trigger unwanted API costs.

5. Best Practices for Safe Automation

Because our tool relies entirely on your local browser, the overall security of your device matters. To automate safely, we strongly recommend the following:

  • Beware of Unverified Extensions: Do not run our extension if you have unverified, sideloaded, or untrusted extensions or applications installed on your device. Malicious apps on your computer could attempt to steal data from your browser.
  • Protect Your Wallet: Always set a strict spending or usage limit on your AI provider’s dashboard. Never plug an unlimited billing API key into any browser extension.
  • Avoid Sensitive Tabs: Do not run web scrapers in the same browser window where you are logged into highly sensitive accounts (like your online bank, cryptocurrency wallet, or workplace cloud consoles).
  • Test Before You Crawl: Before running a massive automated loop across hundreds of pages, run a quick 1-page test to ensure the bot is clicking the right buttons, extracting the correct data, and sending it to the right destination.