Tyton browser extension privacy policy

• The extension has no account and no analytics, and it does not track you
• It makes no AI calls and sends nothing to Tyton's servers or to any other server of ours
• What it reads stays on your device, except for the few requests described in section 4
• We do not sell your data, use it for ads, or let people read it

The extension reads only in the tab where you use it:

• Meta Events Manager pages: what is on the screen, such as business, dataset and Pixel names and IDs, and the setup screens
• The website you ask it to check, once Tyton has access to it as section 6 explains, while the check runs: the page text, the Meta Pixel code, Google Tag Manager container IDs, Shopify's Meta app ID, and the cookie banner's choice. From the list of files and requests the page keeps for itself, it reads only which Meta Pixel scripts loaded and each Meta Pixel request's Pixel ID and event name

When Meta shows you a new Conversions API token, the extension reads it inside Meta's page only to seal it straight away, as section 5 explains.

• Your conversation with Tyton and your setup progress are kept in Chrome's extension storage on your computer. They stay there until you delete them or remove the extension
• Details of a task in progress are kept only until you close Chrome
• Nothing is copied to Tyton or synced to your other devices

The extension sends data in only these ways:

• Google Tag Manager: to check a website, the extension downloads that site's public Google Tag Manager file from googletagmanager.com. The request contains only the container ID, such as GTM-ABC123, and no cookies. Google receives it like any web request, under Google's privacy policy
• Pages you use: Meta's pages and your own website load as they normally do, from Meta and from your website. When Tyton clicks a button for you on Meta, Meta receives that click as if you made it. Meta's privacy policy and your website's own policy apply to those pages
• A sealed token you choose to share, as section 5 explains

If you choose "Yes, create and add them", the extension handles your new Conversions API token like this:

1. Meta shows the new token on its page. The extension seals it right there with Tyton's public key (key ID prod1). Only Tyton's server can open a sealed token. Each sealed token works once, for one Pixel, for 24 hours
2. The extension never stores the plain token and never sends it anywhere. The sealed token goes into the prompt you copy
3. If you give that prompt to your own AI agent, the agent sends the sealed token to Tyton's server at mcp.usetyton.com. Tyton opens it, tests it with Meta, and stores it encrypted so it can send your server events to Meta

Your AI agent is a separate service with its own terms. It only sees the sealed token, which it cannot open.

Tyton keeps the token encrypted while that site is connected to Tyton. People at Tyton do not read it, and support cannot show it back to you. It is deleted when you delete that site in your Tyton dashboard or close your Tyton account. Backups are deleted on their normal cycle. To stop a sealed token from being used twice, Tyton keeps a one-way fingerprint of its one-time ID for about two days. You can also revoke the token in Meta at any time.

The Tyton privacy policy covers how the Tyton service handles everything else. To ask about your data or close your account, email hello@usetyton.com.

• debugger lets Tyton click Meta's buttons for you. While it does, Chrome shows a bar saying that Tyton started debugging this browser. If you close that bar, Tyton stops the task
• scripting lets Tyton read the page you are working on
• activeTab lets Tyton work in the tab you open it in
• storage keeps your conversation and setup progress on your device
• Host access: Tyton always has access to Meta's sites and to Google Tag Manager's public container files. It gets access to your own website only when you open Tyton on it, or when you press Allow Tyton on [your site] and confirm Chrome's prompt during a check. It only reads the tab where you started, while you use it

Because of these permissions, Chrome warns when you install Tyton that it can read and change all your data on all websites. Tyton uses them only as this policy describes.

The extension uses what it reads only to set up and check Meta tracking for you.

• We do not sell it or give it to data brokers
• We do not use it for advertising
• We do not use it to decide creditworthiness or for lending
• We do not use it to train AI models
• We do not transfer it to anyone, except as sections 4 and 5 describe
• People do not read it. It stays on your device, so Tyton cannot see it

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

• Delete your conversation and setup progress in the extension, or remove the extension to delete everything it stored
• Remove a website's access at any time in Chrome: right-click the Tyton icon, choose Manage extension, then Site access
• Do not copy or share the sealed token if you do not want Tyton to save it
• Revoke the token in Meta, or delete the site in your Tyton dashboard

The extension is not for anyone under 16.

When this policy changes, we update the effective date at the top. If the extension starts using data in a new way, we will explain it in the extension and ask you before it happens.

Email: hello@usetyton.com

Kitra LLC 30 N Gould St, STE R Sheridan, WY 82801, USA