Privacy Policy

Last updated: August 19, 2026

This is a draft policy for a product in development; dates and legal review are pending.

What we collect

Nothing. The extension has no analytics, no telemetry, and no backend of its own. Your files are processed on your device and saved only to your Downloads folder — the file itself is never kept in the extension's storage. Your settings, license state and the cached detection model live in the browser's extension storage, on your device, and only for as long as you keep them.

One thing does hold detected personal data, and only in one case: when reversible encryption is off, the mapping between each placeholder and the original value it replaced is kept so that you can restore the file inside the extension. That mapping lives in Chrome's session storage — held in memory, wiped when you close the browser, never written to disk by the extension and never synced. With reversible encryption on, no mapping is stored at all: it travels only inside the decryption token you receive.

The start date of your free trial is also mirrored to Chrome's extension sync storage, so that reinstalling the extension on the same synced Chrome profile resumes the same trial; that marker contains only the start date and an integrity signature — never your files or any detected personal data.

What leaves your device

• Your redacted files go only where you choose to send them (e.g. an AI service you upload them to) — with personal data already replaced by placeholders.
• The on-device detection model (about 900 MB) is downloaded once from Hugging Face — either when you press “Enable on-device AI” in the popup, or automatically in the background the first time the extension protects something (a failed attempt is retried after a cooldown). The download is shown in the popup with a progress bar. It transfers no personal data in either direction; it only fetches the model. Devices that don't support the model never download it, and detection then relies entirely on the built-in rules. After the download, detection is fully offline.
• If you choose to activate a Pro license, the extension sends your license key and an install name to the payment provider (api.lemonsqueezy.com) to activate, validate, or deactivate the license. These requests happen only around your explicit license actions and periodic status checks, and never include your files or any detected personal data. Protecting files is free for a 14-day trial; after the trial, protecting files requires an active Pro license. Restoring a file you already protected never requires a license.

Encryption keys

When you use reversible encryption, a fresh key is generated on your device for each file. The key is placed only inside the decryption token you receive. It is never written to browser sync storage and never transmitted anywhere. If you lose the token, the original cannot be recovered — by design.

Permissions

• Storage — to keep your settings, license state, the trial start date and the cached detection model on your device, and to hold the placeholder mapping in memory-backed session storage while encryption is off.
• Hugging Face domains (huggingface.co and related hosts) — used only to download the detection model.
• api.lemonsqueezy.com — used only for license activation, validation, and deactivation.
• Per-site access — when you add a site to Protected sites, Chrome asks your permission for that specific site (including its subdomains). That access is used only to intercept and redact file uploads on that site. Broad access to all sites is never requested, and with an empty list the extension runs on no web pages at all.

Changes

Any material change to this policy will be reflected here before it takes effect.

← Back to home