Are AI Memory Extensions Safe? Five Checks You Can Run Yourself

In January, two Chrome extensions were caught pulling ChatGPT and DeepSeek conversations off users' screens and sending them to a remote server. Around 900,000 people had them installed. A separate VPN extension with over six million downloads was found intercepting conversations across eight different AI assistants.

According to research by Incogni, 52 percent of AI-powered Chrome extensions collect user data of some kind.

So the question in the title is a fair one, and the honest answer is that it depends entirely on the extension, which is not a useful answer unless you can tell them apart.

Here are five checks. All of them are things you can do yourself in a few minutes, and all of them work on any extension in this category, including ours.

Why this category in particular

An AI memory extension has to read the page to do its job. There is no version of this product that works without access to the text of your conversations.

That is not suspicious in itself. It is the same access a spellchecker needs. But it means the usual advice, which is to avoid extensions that can read page content, would rule out the entire category, and it also means the difference between a safe one and a dangerous one is not about access. They all have access.

The question is never whether it can read your conversations. It is what happens to the text after it does.

Check 1: The permissions it actually asks for

Open chrome://extensions, click Details on the extension, and look at Site access.

A tool that works on six AI platforms should be asking for those six sites. If it is asking for access on all sites, ask yourself what it needs the other several billion pages for. Some tools have a legitimate answer, like saving any web page you choose. Most do not, and a mismatch between what it claims to do and what it asks to see is the single loudest signal available to you.

Check 2: Whether the privacy policy says where your text lives

Open it and search for the words "server", "store", and "local".

You are looking for a specific answer to a specific question: after the extension reads your conversation, does that text stay on your machine, or does it go to the company's servers? A policy that answers this in one sentence is telling you something. A policy that talks about how seriously it takes your security without ever saying where the text goes is also telling you something.

Check 3: Whether they can read it themselves

This is the one that matters most, and the one that gets obscured most often.

"Encrypted in transit" means nobody can intercept it on the way. "Encrypted at rest" means it is not sitting in a plain database. Neither of them means the company cannot read your conversations. In both cases the company usually holds the key.

The real question is who holds the key, and there is a quick way to find out. If you forgot your password, could they still show you your data? If yes, they can read it. That is not an accusation, it is arithmetic.

A policy that is doing this properly will say so explicitly, name the method, and state that no copy of your key exists on their servers.

Check 4: Whether you can leave

Look for an export, and check what format it comes out in.

This is not really a privacy question, it is a leverage question, and it decides how much the first three matter. If a company can read your data and you cannot take it elsewhere, you have no move if their policy changes. If you can leave with everything, a policy change is an inconvenience.

Once you are keeping your working context in one place across several assistants, that archive is often the only complete record of months of work. Being able to walk out with it is not a nice extra.

Check 5: Whether it is still the same extension

Both of the cases above involved extensions that were not malicious when people installed them.

This is the failure mode people never plan for. An extension gets built, gets users, gets sold or updated, and the new version does something the old one did not. Nothing on your screen changes.

Two things to look at. Check the recent reviews rather than the overall rating, because a behavior change shows up in the last month of reviews long before it shows up in the average. And check whether the extension is open source, because a codebase people can read is one where a quiet change is harder to make.

What these checks cannot tell you

They are checks on what a company says and what it asks for. None of them prove what the code does.

An extension can request narrow permissions and still misuse them. A privacy policy is a promise, and promises get broken quietly. The only structural protection is an architecture where the company does not have the ability to read your text in the first place, which is what Check 3 is really testing for. Everything else is trust with extra steps.

Running these on Unibase Memory

It would be strange to publish this without answering it ourselves.

Permissions. It runs on the AI platforms it supports. For saving web pages it uses activeTab, which means a page is read only at the moment you click save, not while you browse.

Where your text lives. On your machine, in your browser's local storage, by default. Sync is off unless you turn it on.

Whether we can read it. No. If you enable sync, content is encrypted on your device before it leaves, using Fernet, which is AES-128-CBC with HMAC-SHA256. The key is derived from your signature and never leaves your browser. There is no copy of it on any server, which means if you lose it we cannot recover your data for you. That is the tradeoff, and it is the one that makes the answer to Check 3 a no.

Whether you can leave. Full JSON export, any time.

The parts that are less flattering. We use Google Analytics for product usage events, which means we can see that a feature was used, tied to a random per-install identifier. Conversation content, titles, tags, highlights, your email and your wallet address are never sent there. Uninstalling clears everything local, but anything you already synced stays in encrypted storage until you remove it. And we are not open source today, so Check 5 is one we currently fail.

Run the same five on whatever else you are considering. If a tool comes out ahead of us on them, use that one. The point of a checklist is that it works regardless of who wrote it.

Add to Chrome: www.unibase.com/invite/BLOG