---
title: "AI Browser Privacy: What Gets Sent to Model Providers"
description: "AI browsers send prompts, snapshots, screenshots and files to hosted models. A sourced audit of Aside, a private agent setup and a checklist for any AI browser."
url: "https://donutbrowser.com/vi/ai-browser-privacy/"
---

1. [Trang chủ](https://donutbrowser.com/vi/)

2. [Blog](https://donutbrowser.com/vi/blog)

3. AI Browser Privacy: What Gets Sent to Model Providers

# AI Browser Privacy: What Gets Sent to Model Providers

October 14, 2026

privacy ai-agents ai-browser

**An AI browser that runs a hosted model sends that model what it needs to act: your prompt, page snapshots, screenshots, files and tool results. The analytics default, the account rules, the content license and the retention clause decide what happens to the rest of your data.**

I make Donut Browser, an anti-detect browser with no built-in model, so read this as a vendor’s audit. The worked example is Aside, an AI browser launched in June 2026, because its privacy policy, terms and help center are public and specific. I retrieved every quote below on 2026-10-14, and each one links to its source.

> **Key Takeaways**

> - A hosted model must see the page to act on it. Aside’s policy says hosted providers “receive the model-visible context needed to run the task.”

> - A “local by default” line on a home page and a privacy policy can describe different things. The policy is the document that binds.

> - The model flow is one of five checks. The others are the analytics default, the account requirement, the content license and retention.

## What does an AI browser send to a hosted model?

An agent works in a loop: it reads the page, picks an action, acts and reads the result. Each turn sends the model a text form of the page, often an accessibility tree, plus your instructions and the results of earlier steps. When text is not enough, the agent sends a screenshot. Files enter the context when the task uses them.

Aside describes this loop in its [engineering post](https://aside.com/blog/how-we-built-the-sota-browser-agent-that-outperforms-fable). Its agent writes Playwright-style code, reads a “customized a11y tree” and falls back to “Computer Use with screenshots” for pages that “cannot be controlled through the DOM.”

So the model sees what is on the page the agent reads: an inbox, a CRM record, a bank statement or a candidate file. A hosted model processes that text on the provider’s servers. What the provider keeps depends on its contract with the browser vendor.

![Diagram: an AI browser with a hosted model sends task context to the model provider and product data to vendor analytics, sync and account systems. Your own agent with Donut Browser profiles reaches the browser through the remote MCP relay or through local CDP on 127.0.0.1.](https://donutbrowser.com/img/blog/ai-browser-privacy.svg)

## What does Aside’s privacy policy say about model providers?

Aside’s [home page](https://aside.com/) says “Local by default” and “Tasks, memory, and data stay on your device. Nothing is shared with LLM providers.”

Section 4 of the [Aside privacy policy](https://aside.com/policy/privacy), last updated June 23, 2026, says:

> “When you run an AI task, the model-visible task context can include your prompts, instructions, tool results, selected browser snapshots, selected screenshots, selected files, and assistant responses. Aside stores task transcripts and task artifacts locally. Hosted AI model providers receive the model-visible context needed to run the task.”

The two statements agree only if “data” means stored transcripts: those stay on your disk, while each step’s context goes to the hosted model. The same section adds that if you “bring your own model or API key, that provider’s terms and privacy policy can also apply.”

The agent’s tools reach far into personal data. Per the help center, a task can “browse sites, search the web, use files, search history, request approvals, and sign in with allowed autofill” ( [Run tasks](https://docs.aside.com/help/tasks)). The policy counts tool results as model-visible context. [Memory](https://aside.com/features/memory) “turns your browsing history into memory,” and the memory files are stored on your device.

Aside also supports local models. Its [changelog](https://docs.aside.com/changelog/components) lists Ollama and LM Studio providers that run “without API keys.” With a local model, the task context stays on your machine. The account, analytics and sync rules below still apply.

## Is analytics sharing on by default in Aside?

Yes. The help center says “Analytics sharing defaults to on” ( [Manage privacy](https://docs.aside.com/help/privacy)). You can turn it off under Settings > Security & Privacy.

The privacy policy lists what product analytics collect “Only when analytics is enabled”:

> “Anonymous analytics ID, product events, page route, settings changes, selected model provider and model, error summaries, feature flag information, email address, plan, Aside component version, timezone, locale, operating system platform, operating system version, and device model.”

The destination is “PostHog and Aside analytics systems.” The ID is called anonymous, and the same row has your email address.

## Do you need an Aside account, and what does it sync?

Yes. The help center says “You need an Aside account and the Aside browser components installed” ( [Get started](https://docs.aside.com/help/get-started)). The October 7, 2026 changelog adds “Disposable-email sign-ups are blocked,” so sign-up needs a lasting email address.

Onboarding offers to import “Browsing history,” “Cookies” and “Bookmarks” from your other browsers. Cookies carry your logged-in sessions, so the import moves those sessions into a browser where an agent acts.

Sync is opt-in per feature. The policy says browser sync holds “Encrypted Chromium sync entity data,” with entity types that include “bookmarks, history, history deletion directives, cookies,” stored in “Aside browser sync systems.” Password vault sync stores “encrypted payloads.”

Two agent defaults matter. The AI-agent password access policy has three options, and “The default is `Always allow`.” The same page says “Saved passwords stay local and hidden from AI,” so the agent signs in with your logins without reading the values ( [Configure password autofill](https://docs.aside.com/help/passwords)). The `Full access` task mode lets Aside “read and write anywhere on the computer,” and `Guard` is the default for new tasks ( [Set agent permissions](https://docs.aside.com/help/security)).

Task output can travel further. Section 5 of the terms says some features need “third-party AI models, cloud execution, account sync, or service providers.” The changelog describes Channels, which post agent runs in “the bound Slack, Discord, or Telegram thread.”

## What license and retention do Aside’s terms set?

Section 6 of the [Aside terms](https://aside.com/policy/terms), last updated June 19, 2026, defines User Content to include “prompts, instructions, browser context, webpage content, files, settings, workflows, feedback.” The license over it reads:

> “You grant Aside a worldwide, non-exclusive, royalty-free, sublicensable, and transferable license to host, store, reproduce, modify, display, transmit, process, analyze, and otherwise use User Content and Output so we can provide, maintain, secure, develop, improve, and enforce the Services.”

On training, the terms say: “By default, we do not use your User Content, Output, browser context, browsing history, password manager data, or files to train AI models.” On providers: “For providers that support it, we configure third-party AI model providers with zero-data-retention, no-training, or equivalent settings.” Neither document lists which providers support it.

Retention is open-ended. Section 7 of the policy says “We keep information as long as we reasonably need it to provide the Services, maintain security, comply with legal obligations, resolve disputes, process billing, and enforce agreements.”

The browser is closed source, and section 3 of the terms forbids you to “reverse engineer, decompile, attempt to extract source code from” it. The policy is your only view of the data flow, so read it before an agent puts client data, candidate files or a CRM export into the context.

| Data | Where it goes | Default | Source |
| --- | --- | --- | --- |
| Prompts, snapshots, screenshots, files, tool results | Hosted model provider | Every task on a hosted model | Privacy policy, section 4 |
| Analytics, including email, plan, model and device model | PostHog and Aside analytics | On | Help center, Manage privacy |
| History, cookies, bookmarks | Aside browser sync, encrypted | Off until enabled | Privacy policy, section 1 |
| Password vault | Aside sync, encrypted | Off until enabled | Privacy policy, section 1 |
| Agent use of saved logins | Autofill, values hidden from AI | Always allow | Help center, passwords |
| Account | Aside account systems | Required | Help center, Get started |

## How do you run a browser agent without an AI browser?

Keep the agent and the browser apart. Run the agent you already use, such as Claude Code, Claude Desktop, Cursor, Codex, VS Code or Zed, and give it browser profiles to drive. The browser adds no model and no second provider.

This is the setup on the [AI agents use case](https://donutbrowser.com/use-cases/ai-agents) page. In Donut Browser, each profile has its own fingerprint, cookies and proxy or WireGuard VPN, and lives on your disk. The desktop app has [zero telemetry](https://donutbrowser.com/no-telemetry), needs no account, and keeps cloud sync off by default. Optional sync is end-to-end encrypted with a key derived from your password (Argon2id, AES-256-GCM), and you can [self-host the sync server](https://donutbrowser.com/docs/self-hosting). The app is open source under AGPL-3.0.

Your model provider still sees what your agent reads. If Claude Code reads a CRM page through Donut, the page text goes to Anthropic under the terms of your plan. Separate profiles limit what the agent can reach: a profile holds only the logins you put in it, so a task in a research profile has no access to your email session.

## What does Donut see when your agent drives a profile?

That depends on the path the agent uses.

Remote MCP goes through Donut’s relay. The desktop app opens an outgoing WebSocket to Donut’s API, and your MCP client sends each call to `https://api.donutbrowser.com/api/mcp` with a `dmk_` bearer credential ( [Remote MCP docs](https://donutbrowser.com/docs/remote-mcp)). The relay is not end-to-end encrypted. Tool calls and their results, such as page text or a screenshot your agent asks for, pass through Donut’s server. Remote MCP needs a sign-in and a paid plan: Solo ($29 a month) covers profiles, proxies, VPNs, groups, extensions and the human-in-the-loop tools, and Pro ($99 a month) adds browser control and recipes ( [pricing](https://donutbrowser.com/pricing)).

The relay cannot reach everything on your machine. No inbound port opens. Tools that read local paths or export secrets answer `TOOL_IS_LOCAL_ONLY`, and proxy passwords come back redacted ( [MCP docs](https://donutbrowser.com/docs/mcp)). You can hold up to 10 credentials, and a revoked one stops working in about 10 seconds.

Recipes are stored in Donut’s cloud, with passwords never recorded, and schedules (Solo and up) are fired by the cloud. An agent can call `send_feedback` to report a failed tool; attached logs have email addresses, IP addresses, web addresses and secrets removed, and each report shows on the app’s Agent page. The agent console keeps its data in memory only.

The local path stays on your machine. The REST API listens on `127.0.0.1:10108` with a bearer token and is off by default ( [REST API](https://donutbrowser.com/docs/rest-api)). `POST /v1/profiles/{id}/run` (Pro) returns a CDP port bound to 127.0.0.1, and Playwright or Puppeteer attaches to it ( [Wayfern docs](https://donutbrowser.com/docs/wayfern)). Page content goes from the profile to your script without Donut’s servers. Your agent’s model calls still go to its provider.

Use the local path for sensitive pages, and the remote path when the agent runs on another machine.

## Which checklist works for any AI browser?

Apply this list to any AI browser, Donut included.

1. Find the model data flow in the privacy policy. Search for “model-visible,” “context” or “screenshots,” and list what goes to which provider.

2. Compare the home page with the policy. If the marketing says “local” and the policy names hosted providers, the policy is what binds.

3. Check the analytics default and what the analytics row contains. An “anonymous” ID next to an email address identifies you.

4. Check whether you need an account, and whether alias or disposable emails work.

5. Read the content license in the terms. Note words like “sublicensable,” “transferable,” “develop” and “improve.”

6. Read the training and retention clauses, and find out which providers have zero data retention.

7. List every sync and relay: history, cookies, passwords, chat channels, cloud execution and remote MCP. Note which are on by default and which are end-to-end encrypted.

8. Check the agent’s default access to passwords, files and the whole disk.

9. Check whether you can pick the model, including a local one, and what still leaves the machine when you do.

10. Check whether the source is open. With closed source, the policy is your only evidence.

11. Check whether each identity gets its own profile, fingerprint and IP. One profile for everything links your accounts; see [how to run an agent on multiple accounts](https://donutbrowser.com/ai-agent-multiple-accounts).

For a side-by-side of the two browsers, see the [Aside alternative](https://donutbrowser.com/alternatives/aside) page. Sales teams that run agents on CRM data can start with [AI agents for sales](https://donutbrowser.com/use-cases/sales-agents), and teams that keep getting blocked can read [why websites flag AI agents](https://donutbrowser.com/ai-agent-bot-detection).

## Frequently asked questions

### Does Aside send my data to AI model providers?

**Yes, when a task runs on a hosted model.** Section 4 of the [privacy policy](https://aside.com/policy/privacy) says hosted AI model providers “receive the model-visible context needed to run the task,” which can include prompts, instructions, tool results, selected browser snapshots, selected screenshots, selected files and assistant responses. With a local model, the task context stays on your machine.

### What data do AI browsers collect?

**Most AI browsers handle five kinds of data:** the task context sent to the model, account details, product analytics, synced browser data such as history and cookies, and saved passwords. Read the policy’s AI section, the analytics default, the content license and the retention clause to see where each one goes.

### Can I use an AI agent in a browser without an AI browser?

**Yes.** Run the agent you already use, such as Claude Code, Cursor or Codex, and connect it to separate browser profiles over [MCP](https://donutbrowser.com/docs/mcp) or CDP. The browser adds no model of its own. Your model provider still receives what the agent reads, under the terms of your own plan.

### What does Donut Browser see when my agent uses it?

**Over remote MCP, each tool call and its result passes through Donut’s relay, and that relay is not end-to-end encrypted.** Over the local [REST API](https://donutbrowser.com/docs/rest-api) and CDP, traffic stays on 127.0.0.1. The desktop app has [no telemetry](https://donutbrowser.com/no-telemetry), and Donut contains no AI model.

### How do I check whether an AI browser is private?

**Start with the privacy policy, since marketing pages can say less.** Find what goes to model providers, the analytics default and contents, the account requirement, the content license and training clause, the retention period, every sync and relay, and the agent’s default access to passwords and files. The checklist above covers each step.

## Sources

[Aside home page](https://aside.com/) · [Aside Privacy Policy](https://aside.com/policy/privacy) · [Aside Terms of Service](https://aside.com/policy/terms) · [Aside: Manage privacy](https://docs.aside.com/help/privacy) · [Aside: Get started](https://docs.aside.com/help/get-started) · [Aside: Configure password autofill](https://docs.aside.com/help/passwords) · [Aside: Set agent permissions](https://docs.aside.com/help/security) · [Aside: Run tasks](https://docs.aside.com/help/tasks) · [Aside components changelog](https://docs.aside.com/changelog/components) · [Aside: How we built a browser agent](https://aside.com/blog/how-we-built-the-sota-browser-agent-that-outperforms-fable) · [Aside Memory](https://aside.com/features/memory). All retrieved 2026-10-14.

## On this page

- What does an AI browser send to a hosted model?

- What does Aside’s privacy policy say about model providers?

- Is analytics sharing on by default in Aside?

- Do you need an Aside account, and what does it sync?

- What license and retention do Aside’s terms set?

- How do you run a browser agent without an AI browser?

- What does Donut see when your agent drives a profile?

- Which checklist works for any AI browser?

- Frequently asked questions

- Does Aside send my data to AI model providers?

- What data do AI browsers collect?

- Can I use an AI agent in a browser without an AI browser?

- What does Donut Browser see when my agent uses it?

- How do I check whether an AI browser is private?

- Sources