隐私政策
海星助手（Astero）浏览器扩展与桌面端 · 生效日期 2026-10-04
海星助手是公司内部员工使用的工作助手，由桌面端程序和一个 Chrome 扩展组成。 扩展的作用只有一个：在员工本人已经登录的浏览器里， 替他读取当前页面的内容、完成他要求的点击和输入。
我们处理哪些数据
- 网页内容——员工当下正在操作的那一个标签页上 已经渲染出来的可见文字，也就是他本人在屏幕上本来就看得见的内容。
- 页面地址与标题——用来确认助手操作的是他指的那一页，并在回话里告诉他操作了哪一页。
- 本地配置——这个浏览器与哪一台本机桌面端配对、该连接使用的令牌、各站点的频率限制。
- 下载文件的本地路径——仅当员工要求助手下载某个文件时，用于告诉他文件存到了哪里。
我们不处理哪些数据
- Cookie 与认证令牌：从不读取，也从不上传。 没有任何功能需要它们。
- 浏览历史、书签、未经员工要求打开的页面。
- 身份信息、健康信息、财务与支付信息、个人通信内容、地理位置。
- 键盘按键记录；扩展不在后台监听页面。
数据去了哪里
扩展不直接把任何数据发到互联网上。它唯一的网络连接是
127.0.0.1 上的一条本地连接，连到员工这台电脑上
运行的海星助手桌面端。
桌面端再按公司的配置，把完成这项任务所需的文字交给公司自有的服务端， 以及公司选用的大模型服务（阿里云百炼 DashScope、DeepSeek，或公司自托管的模型）， 由它生成下一步操作或答复。数据只在完成员工当次请求的范围内被使用。
不出售、不转让
- 我们不出售这些数据，也不把它转让给任何第三方用于其自身目的。
- 不把它用于与助手功能无关的用途。
- 不用它判定信用、不做任何形式的信用评估。
- 不用于广告投放或画像。
扩展申请的权限，各自为了什么
| 权限 | 用途 |
|---|---|
tabs | 找到并聚焦员工指的那个标签页，读取它的地址和标题。 |
scripting | 把扩展自带的函数注入当前页面，提取可见文字、完成点击与输入。 |
debugger | 少数页面（canvas 表格、字体混淆的数字、只认可信事件的输入框）无法只靠 DOM 操作，这时附加开发者协议发送真实输入事件，用完立即断开。只附加到正在操作的那一个标签页。 |
downloads | 保存员工要求下载的文件，并告诉他存到了哪里。 |
storage | 保存与本机桌面端的配对信息和各站点频率限制。不保存页面内容，不保存凭据。 |
alarms | MV3 的后台脚本会被浏览器挂起，用定时器唤醒它重新连上本机桌面端。 |
<all_urls> | 在哪个网站上干活由员工自己决定，没有固定清单。员工没有在桌面端提出具体任务之前，扩展不对任何页面做任何事。 |
保存多久
扩展本身不保存页面内容——读完就交给本机桌面端，不落盘。对话记录与任务记录 保存在公司自有的系统里，按公司内部的数据保留规定处理。
适用范围
本扩展供公司内部员工使用，需配合「海星助手」桌面端才能工作，不单独提供服务。
变更
本政策如有变更，会更新本页并修改页首的生效日期。
联系我们
对本政策或数据处理有任何疑问：hyouhaku@gmail.com
Privacy Policy
Astero Assistant browser extension and desktop app · Effective 2026-10-04
Astero Assistant is an internal work assistant for our own employees. It consists of a desktop application and a Chrome extension. The extension has one job: inside the browser session the employee is already signed in to, read the page they are working on and perform the clicks and typing they asked for.
What we handle
- Website content — the rendered, visible text of the single tab the user is currently acting on; that is, what the user can already see on their own screen.
- Page URL and title — to confirm the assistant is acting on the page the user meant, and to report back which page it worked on.
- Local configuration — which local desktop app this browser is paired with, the token for that loopback connection, and per-site rate limits.
- The local path of a downloaded file — only when the user asks the assistant to download something, so it can tell them where it went.
What we do not handle
- Cookies and authentication tokens are never read and never transmitted. No feature needs them.
- Browsing history, bookmarks, or pages the user did not ask the assistant to work on.
- Personally identifiable information, health information, financial or payment information, personal communications, or location.
- Keystroke logging. The extension does not monitor pages in the background.
Where the data goes
The extension sends nothing to the internet directly. Its only network
connection is a loopback connection to 127.0.0.1 — the Astero desktop app
running on the user's own machine.
The desktop app then passes the text needed for the requested task to our own company backend and to the language-model service the company has configured (Alibaba Cloud DashScope, DeepSeek, or a self-hosted model), which produces the next action or answer. The data is used only to carry out the user's request.
No sale, no transfer
- We do not sell this data and do not transfer it to third parties for their own purposes.
- We do not use it for purposes unrelated to the assistant's single purpose.
- We do not use it to determine creditworthiness or for any lending purpose.
- We do not use it for advertising or profiling.
Permissions and why each is needed
| Permission | Purpose |
|---|---|
tabs | Find and focus the tab the user meant, and read its URL and title. |
scripting | Inject functions that ship inside the package into the current page, to extract visible text and perform the requested click or typing. |
debugger | Some pages cannot be driven through the DOM alone (canvas-rendered tables, font-obfuscated digits, inputs that only react to trusted events). For those, the DevTools protocol is attached to the single tab being acted on to dispatch real input events, and detached immediately afterwards. |
downloads | Save a file the user asked the assistant to download, and report its local path. |
storage | Store the pairing with the local desktop app and per-site rate limits. No page content and no credentials are stored. |
alarms | Wake the suspended MV3 service worker so it can re-establish the connection to the local desktop app. |
<all_urls> | The user decides which site to work on; there is no fixed list. The extension does nothing on any page until the user requests a specific task in the desktop app. |
Retention
The extension itself stores no page content — it hands the text to the local desktop app and keeps nothing on disk. Conversation and task records live in our own systems and are kept according to our internal retention rules.
Scope
The extension is for our own employees and does not work on its own; it requires the Astero desktop application.
Changes
If this policy changes, this page is updated and the effective date above is revised.
Contact
Questions about this policy or our data handling: hyouhaku@gmail.com