Sunda Privacy Guard
Privacy Policy
Last updated: July 20, 2026
This is a draft policy for a product in development; dates and legal review are pending.
The short version. Sunda Privacy Guard processes everything on your device. It makes no network requests to detect or redact your data, sends no telemetry, and requires no account. The extension talks to the internet for exactly two things: a one-time download of the on-device detection model (about 900 MB, from Hugging Face — visible in the popup with a progress bar), and, only if you choose to activate a license, license verification with the payment provider. Neither request carries your files or any personal data found in them.
What we collect
Nothing. The extension has no analytics, no telemetry, and no backend of its own. Your files, and the personal data detected in them, are processed on your device and saved only to your Downloads folder — they are never kept in the extension's storage. Your settings, license state, the local placeholder mapping, and the cached detection model live in the browser's extension storage, on your device, and only for as long as you keep them.
What leaves your device
- Your redacted files go only where you choose to send them (e.g. an AI service you upload them to) — with personal data already replaced by placeholders.
- The on-device detection model (about 900 MB) is downloaded once from Hugging Face — either when you press “Enable on-device AI” in the popup, or automatically in the background the first time the extension protects something (a failed attempt is retried after a cooldown). The download is shown in the popup with a progress bar. It transfers no personal data in either direction; it only fetches the model. Devices that don't support the model never download it, and detection then relies entirely on the built-in rules. After the download, detection is fully offline.
- If you choose to activate a Pro license, the extension sends your license key and an install name to the payment provider (api.lemonsqueezy.com) to activate, validate, or deactivate the license. These requests happen only around your explicit license actions and periodic status checks, and never include your files or any detected personal data. No feature currently requires a license.
Encryption keys
When you use reversible encryption, a fresh key is generated on your device for each file. The key is placed only inside the decryption token you receive. It is never written to browser sync storage and never transmitted anywhere. If you lose the token, the original cannot be recovered — by design.
Permissions
- Storage — to keep your settings, license state, the local mapping (when encryption is off), and the cached detection model on your device.
- Hugging Face domains (huggingface.co and related hosts) — used only to download the detection model.
- api.lemonsqueezy.com — used only for license activation, validation, and deactivation.
- Per-site access — when you add a site to Protected sites, Chrome asks your permission for that specific site (including its subdomains). That access is used only to intercept and redact file uploads on that site. Broad access to all sites is never requested, and with an empty list the extension runs on no web pages at all.
Changes
Any material change to this policy will be reflected here before it takes effect.