The first question everyone asks about browser sharing is: "Is my data safe?" The short answer is yes — and here's exactly how session isolation works to protect your personal information.
The incognito barrier
Every guest session runs in a dedicated Chrome incognito profile. This isn't regular incognito mode — it's a fully isolated browser context with zero access to your default Chrome profile. What this means: separate cookie jar, separate localStorage and sessionStorage, no access to saved passwords or autofill, no bookmarks, no browsing history, no installed extensions, no downloads or file system access. When the session ends, ALL incognito data is deleted. The guest starts with a completely blank Chrome window.
Command restrictions
Even within the incognito session, guests can only use a whitelisted set of commands. Allowed: navigate to URLs, click at coordinates, type text, take screenshots, scroll, upload files, query DOM elements. Blocked: access file system, manage extensions, open DevTools, execute arbitrary JavaScript, modify Chrome settings, open new windows outside incognito, access other tabs. These restrictions are enforced at the extension level.
Domain blocklist
Hosts configure a list of domains that guests cannot visit. Attempting to navigate to a blocked domain is silently prevented. Common blocklist entries include banking sites, email providers, social media accounts you personally use, and other sensitive domains.
Human action requests
Some tasks require human intervention — solving a CAPTCHA. These are handled through the chat system: agent sends a request, host receives notification, host can see the page state, host chooses to help or decline, performs the action, confirms completion. Every step requires explicit host approval. Hosts can end the session at any time.
What the guest does get
Your real IP address (websites see your residential IP), your real hardware fingerprint (WebGL, Canvas, AudioContext from your actual GPU/CPU), your real timezone and locale, your real screen resolution and fonts. This is what makes the service valuable — agents pay for authenticity. But none of this is personal data like passwords, accounts, or browsing history.