Privacy policy

Effective 13 October 2026. Applies to the Weft desktop app and the Weft Chrome extension.

Short version: Weft runs entirely on your own computer. It has no account, no servers and no telemetry. Nothing Weft handles is sent to the Weft developer or to any third party.

What the extension accesses

Only for a site you explicitly convert by clicking Convert this site to MCP, and only after you grant Chrome's permission for that site, the extension accesses:

• Network activity of that site's tab — only each API request's method, URL and status code — so Weft can learn the site's API. Request and response headers and bodies are not collected. Chrome's debugger permission is used to observe these requests, and Chrome shows a visible banner while it's active.
• Cookie names and web-storage keys for that site, so Weft can tell how the site authenticates. Cookie and storage values are never read into Weft.
• Authentication headers that the site's own JavaScript sends (for example Authorization or a CSRF token). The extension keeps the latest value in the browser's in-memory session storage, readable only by the extension and cleared when the browser closes, and adds it to requests you ask for in that site's tab. Only the header name is sent to the Weft app; the value never leaves the browser.
• The current tab's address, to show which site you're on.

When your AI client asks Weft to call the site, the extension runs that request inside your open tab of the site, so your existing session is used by the browser itself. The response is passed back to the Weft app and on to your AI client.

Where that data goes

Only to the Weft desktop app on the same computer, over 127.0.0.1 (your machine's loopback address). The app keeps a map of each converted site's endpoints in a local file so it survives restarts, and a short in-memory feed of recent requests. Responses to your AI's requests go to the AI client you connected — which you choose and configure yourself, under that client's own privacy terms.

What Weft does not do

• No analytics, tracking, crash reporting or telemetry of any kind.
• No accounts, and no data sent to the developer or any server.
• No selling, sharing or transferring of user data to third parties.
• No use of data for advertising, credit-worthiness or lending purposes.
• No capturing of sites you haven't converted.

Your control

Pause or delete any converted site in the Weft app, remove the extension from chrome://extensions, and delete Weft's local data folder (see Uninstall) to remove everything.

Open source

Weft is open source under the MIT license, so you can verify all of the above in the source code.

Contact

Questions or concerns: open an issue on GitHub. Security reports: see SECURITY.md.