Browser extensions & workspace privacy
AI assistant extensions — ChatGPT and Gemini sidebars, Monica, Sider, Merlin, HARPA and dozens of others — can read every page you have open, including your Kavanah workspace. This page states exactly what they can reach, what Kavanah does about it, and what actually stops them.
The honest headline: no website can block a browser extension that is installed in your browser. Not Kavanah, not your bank, not anyone. Browser extensions are granted their access by you (or by whoever administers your device), and that grant sits above the website. Anything that claims otherwise is selling you a feeling.
Why a website cannot block an extension
Websites defend themselves with a Content Security Policy — a header that tells the browser which scripts may run and where data may be sent. Kavanah ships a strict one. It has no effect on extensions, by design:
- Extensions run in an isolated world.A content script executes in a separate JavaScript context that the browser deliberately exempts from the page's Content Security Policy. Tightening our CSP does not restrict it.
- They read the finished page. An extension sees the rendered DOM — the same task titles, documents, messages and client data you see on screen. Encryption in transit and at rest protects data on the wire and in our database; it cannot protect a screen that is being read locally.
- They send data through their own process. Exfiltration happens from the extension's background service worker, which is not our origin and is not covered by our
connect-src policy.
What a browser extension can access in a Kavanah session
It can read
- Everything rendered on screen: task titles and descriptions, project names, client records, chat and discussion threads, knowledge-base documents, reports, and anything you scroll past.
- Text you type into Kavanah, including into the AI agent — keystrokes in a page are visible to a content script.
- Browser storage on the
kavanah.ai origin (localStorage and sessionStorage), which holds UI preferences. - The URLs you visit inside the workspace, which leak structure even when the extension is not reading page content.
It cannot reach
- Kavanah's database, or any workspace, project or record you yourself cannot open. An extension inherits your access — it does not escalate it.
- Other members' sessions. What one member's extension sees is bounded by that one member's permissions.
- Your Kavanah session cookie from page JavaScript — it is
HttpOnly. Note that an extension granted the browser's cookie permission can still read cookies through the browser's own API, so treat this as a speed bump rather than a wall. - Data on the server side of an integration (the contents of a connected Google account, for example) except insofar as Kavanah renders it into a page you have open.
What Kavanah does
Detection and warning
Every authenticated page watches for extension overlays being injected into the workspace. Detection works two ways: a curated list of known AI sidebar mount points, which lets the warning name the tool, and a vendor-agnostic scan for elements loading resources from an extension package (chrome-extension://, moz-extension:// and the Safari and Edge equivalents), which catches extensions nobody has catalogued. When something is found, a privacy warning appears naming what was detected.
Extension Shield
Extension Shield is an opt-in mode under Settings → Security & 2FA. When it is on, Kavanah hides detected overlay hosts so they cannot render on top of your workspace, and the privacy warning can no longer be dismissed — so a member cannot silence it and forget an assistant is watching.
It can be enabled two ways, and either one turns it on:
- This browser — a local preference for your own browser. Nothing is sent to the server.
- Everyone in this workspace — a workspace security policy, admin-only, off by default. Turning it on applies the shield for every member and removes their ability to dismiss the warning.
Extension Shield is containment, not a boundary. It stops an overlay from rendering over your work and makes the exposure visible and un-ignorable. It does not stop the extension from reading the page, because — as above — nothing served from a website can.
What actually stops an extension
- 1Use the Kavanah desktop app. Its native shell loads no third-party browser extensions at all. This is the strongest and simplest answer for sensitive work.
- 2Remove or disable the extension, or restrict its site access. Chrome, Edge and Firefox all let you set an extension to run only on sites you click it on — do that, and leave
kavanah.ai off the list. - 3Use a dedicated browser profile with no extensions installed, and open Kavanah only there.
- 4Apply an enterprise extension policy. On managed devices, Chrome Enterprise, Edge and Firefox all support blocklists and allowlists pushed by the administrator. This is the only control that binds members who will not manage their own browsers.
If the name Kavanah shows is not in your extensions list
The name in the warning is taken from the markup the extension injects, which identifies the vendor— not necessarily the title the extension is listed under. One vendor often ships several extensions from a single codebase, so they all inject the same markup, and the one you actually installed may not carry the vendor's name anywhere.
The common example is Glasp. Nothing in your extensions list is called “Glasp” unless you installed their highlighter — the usual culprit is “YouTube Summary with ChatGPT & Claude”, which despite the name runs on every site you visit, not only YouTube, and adds a floating summarise button to the page. An extension's title tells you what it is for; it tells you nothing about where it is allowed to run.
Finding the real one
- 1Open
chrome://extensions (or edge://extensions, about:addons in Firefox) and read the whole list rather than searching it for the name in the warning. - 2Look past the titles at what each one does: anything that summarises, highlights, translates, rewrites, takes notes or adds a sidebar is a candidate, whatever it is called.
- 3If the warning showed an id underneath the name, paste
chrome://extensions/?id=followed by that id into the address bar — it opens that exact extension's page, no guessing. (Not every detection has an id: an extension whose code is loaded indirectly leaves nothing in the page to read one from.) - 4Otherwise switch extensions off a few at a time and reload Kavanah. The warning clears on the reload after you disable the right one.
- 5Open your browser console on a Kavanah page and look for the line
[kavanah] browser extension detected. It records the element that tripped the warning, the store titles the vendor publishes under, and the extension id where one is available. - 6Or ask support. Kavanah records each detection against your account: the extension's name, the element it injected, its id where one is available, and your browser version. It never records what was on the page. Support can look the detection up without you opening any developer tools.
The warning is about what an extension canread, not a claim that it is misbehaving. Most of these tools are doing exactly what they advertise. The point is that “runs on every site” includes your workspace, and that is worth knowing.
If an extension you did not install appears
An extension appearing in your workspace means it is installed in your browser profile, not that Kavanah loaded it. Common causes are a bundled install alongside other software, a Chrome profile signed into a different Google account that syncs extensions across devices, or an extension pushed by a device-management policy.
- 1Open your browser's extensions page and review everything listed, including entries marked as installed by an administrator or by enterprise policy.
- 2Remove anything you do not recognise, and check whether your browser profile is syncing extensions from another account.
- 3Turn on Extension Shield so any future injection is surfaced immediately rather than sitting quietly in the corner of the page.
- 4If the extension was installed by policy on a managed device, raise it with whoever administers that device — it cannot be removed from inside the browser.
Sensitive-project rule of thumb: extension hygiene is password hygiene. An AI sidebar with access to your workspace has, in practice, the same read access to your intellectual property that you do.
