Skip to content
Page2AI

Privacy Policy

Effective date: 2026-07-24. Applies to: Page2AI Chrome extension (Manifest V3), @page2ai/core npm package, @page2ai/mcp MCP server, and the unscoped page2ai-mcp wrapper. Author: Igor Saevets (igorsaevets@gmail.com, ORCID 0009-0006-8636-1377).

Summary

Section titled “Summary”

Page2AI does not collect, transmit, sell, share, or store any personal data. There is no telemetry, no analytics, no crash reporting, no A/B testing, and no third-party services embedded in any of the products.

Every product in the suite runs entirely on the user’s own machine.

What each surface does with your data

Section titled “What each surface does with your data”

Chrome extension

Section titled “Chrome extension”
  • Runs on the current tab only when you invoke it (Alt+Shift+M or click the toolbar icon). Manifest requests only activeTab, scripting, clipboardWrite, and storage. No host_permissions, no <all_urls>, no tabs API access.
  • Reads the DOM of the active page to extract content.
  • Writes to your clipboard the resulting Markdown, so you can paste it into your LLM of choice.
  • Stores locally (via chrome.storage.session) the last extraction result per tab, so re-invoking the icon retrieves a cached result. Cleared on tab close or navigation. Never sent anywhere.
  • Does not transmit page contents, URLs, or any other data off your machine.

@page2ai/core npm library

Section titled “@page2ai/core npm library”
  • Runs synchronously in Node.js or in a browser bundle. Consumes an HTML string or a URL you provide.
  • fetchAndConvert(url, opts) makes a single outbound fetch() to the URL you pass in — nowhere else. It enforces the SSRF guards below.
  • Emits Markdown, returns it to your code. No storage, no logging.

@page2ai/mcp MCP server

Section titled “@page2ai/mcp MCP server”
  • Runs as a stdio process spawned by your MCP client (Claude Desktop, Cursor, Windsurf, Zed).
  • Exposes one tool, page_to_markdown. When your agent calls it, the server fetches the URL your agent provided and returns the extracted Markdown to the agent.
  • Server-side safety rules:
    • HTTPS only — http:, file:, data:, javascript: schemes are rejected.
    • SSRF guard — blocks loopback, private IPv4 (10/8, 172.16/12, 192.168/16), link-local (169.254/16 including cloud metadata endpoints), IPv6 loopback and private ranges. Applied both pre-request and post-redirect on the final URL.
    • 10 MB response cap.
    • Timeout enforced by AbortController, default 15 s, hard cap 60 s.
    • UTF-8 only on response body.
  • Does not log requests, does not persist anything to disk. All state is per-invocation.

Third parties

Section titled “Third parties”

None. The products do not embed any third-party SDKs, trackers, analytics, remote configuration services, feature-flag services, or CDNs.

The one exception: @page2ai/mcp depends on @modelcontextprotocol/sdk from Anthropic. That SDK is used only to speak the MCP protocol over stdio to the client. It makes no network calls in the code path this server exercises.

Children’s privacy

Section titled “Children’s privacy”

The products are general-purpose developer tools and are not directed at children under 13.

Changes

Section titled “Changes”

Material changes to this policy will be published to this page and to the extension’s Chrome Web Store listing with an updated effective date.

Contact

Section titled “Contact”

Source

Section titled “Source”

This policy applies to the products at these canonical locations: