Privacy policy — Sovereign Shield browser extension

The short version

The extension does its work entirely inside your browser. It collects no personal data, transmits nothing on its own, and has no server, account, API key or analytics. The one and only way anything reaches the developer is if you click to report a site that stopped working — described below, and it carries no prompt content.

What the extension does

On gemini.google.com, chatgpt.com, chat.openai.com and claude.ai, it inspects the request the page is about to send to its model, replaces any checksum-validated identifier, secret/API key, or custom term you configure with a placeholder before the request leaves your browser, and restores the real value in the reply you read — and in what you copy from it, so the clipboard matches the screen. This all happens locally, in the page.

Before you send, a small counter above the chat box previews how many identifiers will be kept local. It reads your prompt text entirely within transient page memory — it never touches the network, is never written to disk, and is gone the moment the tab closes.

Data handling

Identifier values are never stored or transmitted. The map linking a value to its placeholder lives only in the page's memory for the life of the tab and is discarded when the tab closes or reloads.
Local settings. Your on/off toggle and per-category choices are saved in the browser's own extension storage (chrome.storage.local) on your device only.
Activity log. An on-device log records, for each redaction, the identifier type, the time, and the site — and never the value, not even a masked one. It is a rolling window you can erase at any time from the options page, and it never leaves your device.
Aggregate statistics. The options page shows lifetime counters of how many identifiers were kept local — per type, per site, and per day (daily counts are kept for about 90 days; lifetime totals indefinitely). These are counts only, never values, stored in the same on-device extension storage, resettable at any time from the options page, and they never leave your device.
Breakage reports are opt-in, one click at a time. If a site changes its API and a message goes out uninspected, the warning banner offers to report it. Clicking opens a prefilled GitHub issue — or your mail client — containing four facts: the site's hostname, the extension version, the build stamp, and the symptom. Never any prompt text, redacted value, placeholder or custom term. Nothing is sent unless you click, and you can read and edit it before you send it.
No collection, no tracking. Apart from a report you choose to send, no data reaches the developer or anyone else. There are no cookies, no analytics, no remote code.

Permissions, and why

Host access to the four chat sites above — required to read and rewrite the outgoing request so identifiers can be redacted before they are sent, and to restore them in the displayed reply. The extension runs on those sites only.
Storage — to remember your settings and the value-free activity log on your device.

Your control

Clear the activity log or reset the aggregate statistics any time from the options page. Removing the extension deletes all of its local data. You can also disable the guard, or any individual category, from the popup or options page.

Scope

The extension detects checksum-validated identifiers, common secret and API-key formats, and any custom keywords or patterns you configure. It does not attempt to detect names or addresses. It guards the prompt you type; it does not inspect the contents of files you attach — an uploaded document or codebase reaches the AI service as-is, so treat attachments as an unguarded channel. It is an independent open-source project and is not affiliated with Google, OpenAI or Anthropic.

Contact

Questions or issues are welcome on GitHub: github.com/acoseac/sovereign-shield