Privacy — Ollama Sidekick

Last Updated: July 26, 2026

Model context and capability data

Ollama Sidekick sends only the context assembled for the request you make to the endpoint configured for the selected model. Complete local chat history may be represented by a smaller rolling summary in an outbound request; the original messages and summary state remain in the browser's local extension storage.

Capability discovery contacts only configured Ollama or OpenAI-compatible model endpoints. Discovery requests contain no chat, page, screenshot, or summary content. Context diagnostics contain token counts and model-limit provenance only; they do not store prompts, page content, summaries, screenshots, API keys, or full conversation history.

Overview

Ollama Sidekick is a browser extension that provides a chat interface to local Ollama models and cloud model services that you explicitly configure.

Our Privacy Commitment

Ollama Sidekick does not operate analytics, advertising, tracking, or developer-owned data servers.

Local Ollama use stays on the endpoint you configure. If you add a cloud model connection, prompts, enabled page context, conversation history needed for the request, and optional screenshots are sent directly to that provider under its own privacy policy.

The extension does not receive persistent access to every website when it is installed. One-off current-page features use Chrome's temporary activeTab grant. If a feature needs continued access to a website or a configured remote provider, Chrome asks for that exact scheme and hostname at runtime; the user may deny or later revoke the grant.

Data the Extension Developer Does Not Collect

• Personal information sent to developer-owned systems
• Browsing history sent to developer-owned systems
• Page content sent to developer-owned systems
• Chat conversations sent to developer-owned systems
• Usage analytics
• Cookies or tracking data
• IP addresses
• Device identifiers

Data Stored Locally on Your Device

The following data is stored on your device using Chrome's extension storage APIs, in the location shown for each row:

This stored configuration is not sent to the extension developer. API keys are kept in a dedicated local storage entry (not in the cloud-connection metadata list), are not synced, and are never exposed to webpage content scripts. Removing a cloud connection or clearing extension data removes the stored key.

In split incognito mode, chats and Agent Mode checkpoints remain in memory or session storage for that incognito context. They neither read from nor write to ordinary persistent chat/run history.

Agent Mode durable records are bounded, redacted before storage, and automatically expire. A checkpoint retains the user-supplied task contract and, when needed for safe recovery, the exact pending action and approval binding. The compensation transaction format can retain a bounded, integrity-sealed inverse only when an exact semantic inverse survives redaction and can be verified against the same origin, account, document, URL, and after-state. Generic DOM events and browser navigation do not currently meet that standard, so they are not persisted or offered as Undo authority. If a site-specific inverse is added later, a successful Undo will mark its one-owner source record consumed rather than creating background authority. Raw page extracts, extract source URLs, archived page snippets, and screenshots are omitted; credential, payment, and other recognized secret patterns are redacted. Task-scoped memory can be inspected, corrected, exported, deleted, or disabled from the active task UI. Deleting a chat also deletes every durable Agent Mode run and active-run pointer associated with that chat; a deletion tombstone prevents an in-flight cancellation from recreating those records.

Chrome separately manages host-permission grants. Users can review or revoke site access in Chrome's extension settings or from Sidekick's Diagnostics panel. Revoking a Chrome grant does not transmit anything to the extension developer.

Page Content Processing

When you use Ollama Sidekick:

1. You invoke a current-page or Agent Mode feature.
2. Chrome must have granted temporary activeTab access or access to that

exact site origin.

1. The packaged content script is injected on demand; it is not installed as a

passive script on every webpage.

1. Relevant content is processed locally in your browser.
2. Content included in the request is sent to the model endpoint selected for

that request.

1. With a local Ollama model, that is your configured Ollama server.
2. With a cloud model, that is the cloud API URL you explicitly saved.

On sites for which persistent access has been granted, Sidekick may refresh the local current-page context after navigation so the side panel does not use stale content. Page content is not sent to a model until you make a request with that context enabled.

Network Connections

Ollama Sidekick makes model requests only to endpoints configured by you:

Loopback access is part of the required installation permissions. A remote provider requires an exact runtime host grant and must use HTTPS. The manifest's optional HTTP(S) patterns only declare which origins Chrome may let the extension request later; they do not grant all-site access at installation.

The extension does not:

• Send model data to developer-owned servers
• Include any analytics or tracking scripts
• Load resources from external CDNs (all assets are bundled)

Third-Party Services

Cloud integrations are opt-in and use an OpenAI-compatible API supplied by you. The provider receives only requests you initiate while one of its models is selected. Your relationship with that service—including retention, training, and billing—is governed by the provider's terms and privacy policy.

Permissions Explained

The extension requests neither the tabs nor webNavigation permission and has no required <all_urls> permission or passive all-page content script.

Data Security

• Cloud API URLs must use HTTPS, except for localhost gateways
• API keys remain in dedicated local extension storage and are sent only as authorization headers to the matching endpoint
• Page scripts cannot access model credentials
• You can disable page context before sending a request
• Extension pages execute only packaged scripts under a strict Content Security

Policy; remote code and string evaluation are not allowed

• Optional site access is requested for an exact scheme and hostname, never a

wildcard subdomain or <all_urls> grant

Children's Privacy

Ollama Sidekick does not collect any data from any users, including children under 13.

Changes to This Policy

If we update this privacy policy, we will:

• Update the "Last Updated" date
• Include changes in the extension update notes
• Maintain previous versions in our repository

Your Rights

Since we don't collect any data:

• There is no data to request, modify, or delete from our servers
• You have full control over locally stored data through your browser settings
• Uninstalling the extension removes all local data

Summary

---

This privacy policy is effective as of July 26, 2026.