Privacy Policy

Last updated 1 October 2026

Wyatt is a Chrome extension that browses LinkedIn, X, and Instagram in your own browser, under your own logged-in session, to find people matching a description you write and to draft messages to them. This page explains what leaves your browser, who it goes to, and how long it is kept.

The short version

What we collect

Your account

When you create an account we store your email address, a scrypt hash of your password, the time you signed up, and an anonymous install identifier generated by the extension. If you arrived from an ad we store the campaign parameters from that link. Your session is stored as a SHA-256 hash of the session token, so a copy of our database does not let anyone sign in as you.

Payments

Payments are processed by Stripe. Card numbers are entered into Stripe’s own fields and never reach our servers. We store the Stripe customer identifier, the identifier of a saved payment method, your auto top-up preferences, and a ledger of the time you have purchased. When you save a card we also store the name, billing address and phone number you gave Stripe, and we use them to match your milestones to Meta and LinkedIn as described under Advertising below. Stripe’s handling of your payment details is governed by its own privacy policy.

What Wyatt reads while it runs

During a run, Wyatt reads the pages you sent it to: search results, and the public profiles of the people it finds. The details it takes from a profile — name, headline, employer, location, recent posts, and the profile URL — are sent to our server, which passes them to a language-model provider to decide whether that person fits your description and to draft a message. Where a page cannot be read from its markup, Wyatt captures an image of the visible tab and sends that image to the same provider to be read. Those images are used for that one request and are not stored.

To plan a search and to check what it finds, the model may also search the open web. We record which pages it was given, alongside the cost of the call.

Contact details of the people you find

When you ask Wyatt for a work email address, we send that person’s profile URL to a third-party business-contact data provider and store what comes back: their work history, their current employer, and a work email address with the provider’s assessment of whether it is deliverable. That record is keyed by the profile URL and is shared between accounts, because a person’s work history does not depend on who is asking. It carries no record of which user requested it. It is kept until deleted on request.

Operational records

We log each call to a model or a data provider: the time, the route, the model, the number of tokens, the cost, and whether it succeeded. These records carry your user or install identifier, so we can tell what an account costs to serve. We also count how many result pages were read per platform per hour, with no identifier attached, so we can tell when a platform has changed its layout.

Product events

We record the steps a person takes with Wyatt, starting on this site: a page here was viewed (with the site that sent you there), the panel was opened, a search started, a run finished, a file was exported, a connection request or message was sent, hours were bought, the extension was removed. Each event carries the platform it happened on, a count where one applies, and an anonymous identifier for your browser or install — or, once you have an account, your user identifier and email address, so that the steps before you signed up and the steps after read as one person. An event says that a message was sent, never to whom or what it said; that a search ran, never what it was for. We send these events to Amplitude, a product-analytics service, from our own server, and read them in aggregate to see where people get stuck.

We also record sessions in the extension’s side panel with Amplitude.

Error reports

When something in the extension or on this site breaks, it reports the error to our server: the kind of error, its message, where in our code it happened, the version you were running, and your install identifier. Messages are filtered for email addresses, profile links and long numbers before they leave your browser and again on our server. We forward the report to Sentry, an error-tracking service. The extension reports only errors in its own panel and background code, never errors on the pages it visits.

Stored on your own machine

The extension keeps the state of a run in Chrome’s local storage: where the run got to, the people already seen, your saved settings, the install identifier, and the time you installed. This stays on your computer. Only the install identifier is ever sent to us, and, while we are running ads, on to Meta and LinkedIn as described under Advertising below.

Who we share it with

We use a small number of processors and share with each only what it needs to do its job: OpenRouter, which routes requests to language-model providers; a business-contact data provider, for the work histories and email addresses described above; Stripe, for payments; Vercel, which hosts our application; Turso, which hosts our database; Amplitude, for the product events described above; Sentry, for error reports; Brevo, for email; and, while we are running ads, Meta and LinkedIn — described in full in the next section. Every one of these receives what it receives from our server, not from your browser; the two exceptions are Meta’s pixel and LinkedIn’s Insight Tag, described below. We do not sell personal data or share it with data brokers. We will disclose data where the law requires it.

Advertising and this website

While we are running ads, we tell Meta and LinkedIn when someone who came from one of them reaches a milestone, so we can work out which ads are worth paying for. The milestones are: a page on this site was viewed, Wyatt was opened for the first time, a first search was started, an account was created, and a card was added. That is the whole list. Each of them can also use it to show you Wyatt’s ads again elsewhere.

This reaches Meta two ways, and you should know about both:

The same milestones reach LinkedIn two ways:

What we never send is the work. No profile Wyatt read, no person it found, no message it drafted, and no search you wrote reaches Meta or any other advertising service, and none of it is used to target advertising — the milestone we send says a search started, never what it was for. Neither tag is in the extension.

If you would rather none of it happened: you can opt out of this kind of ad targeting in your Meta and LinkedIn account settings, you can clear this site’s cookies in your browser, and you can ask us to delete your records at any time. A tracker blocker stops the pixel and the Insight Tag in your browser. It leaves the half we send from our server running, and the site sets the pixel’s two cookies itself when the pixel cannot.

The permission Chrome asks you to grant

Chrome warns that Wyatt can read and change data on all websites. It needs that because you choose which network to search, and because a run has to follow links to profiles wherever they lead. Wyatt injects its reader only into a tab belonging to a run you started, and only on the platform that run targets. It does not read the other tabs you have open.

While a run is working, Chrome shows a bar saying Wyatt started debugging this browser. That is the browser’s name for the permission Wyatt uses to click and type on the page the way you would. Wyatt uses it for clicks and keystrokes only, on the one tab the run is driving, and only while the run is going. It does not use it to read the page, your network traffic or your console. The bar goes away when the run stops, and its Cancel button stops the run.

How long we keep it

Your choices

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Deleting your account removes your account record, your sessions, your ledger, your run history, and the advertising identifiers we hold against your anonymous identifier. You can also ask us to delete the record we hold for a particular person, whether or not that person is you — send us the profile URL. Clearing the extension’s data in Chrome removes everything stored on your machine.

Depending on where you live you may have further rights over your personal data, including the right to object to processing and to complain to a data protection authority.

Children

Wyatt is a tool for work and is not intended for anyone under 16.

Changes

If this policy changes we will update the date at the top of this page. Material changes will be announced in the extension before they take effect.

Contact

Write to support@hirewyatt.com for access, correction, or deletion requests, or with any question about this policy.