Aalto records only while you hold the talk button. Chrome needs your permission once, from a normal page like this one - the part of Aalto that listens runs invisibly and isn't allowed to ask.