Maskr Privacy Policy
In short: Maskr checks what you're about to send to AI chatbots — the prompts you type and the files you attach — and it does this entirely on your own device. Nothing you type, no file you attach, and nothing Maskr finds is ever sent to us or to anyone else. There are no servers, accounts, analytics, ads or tracking.
What Maskr does
Maskr is a browser extension that warns you, or stops a prompt, before you send personal data or secrets (for example an Aadhaar or PAN number, a bank account, a card number, an API key or a password) to an AI chat website. It can also replace just those details with placeholders such as [AADHAAR] and send the rest.
It checks the files you attach in the same way — photos and screenshots (for example of an ID card or a bank card), PDFs and text files — and can attach a copy of an image with the sensitive details blacked out instead — including the photo, QR code and signature on an ID card.
The information Maskr handles
To do its one job, Maskr reads the text you submit on supported AI chat websites (ChatGPT, Claude, Gemini and Copilot) and on any other chat site you choose to add. That text may contain personal, financial, health or login information. It is examined on your device, by pattern matching and by an AI model that is bundled inside the extension, at the moment you press send.
Maskr also reads the files you attach on those sites — images, PDFs and text files — when you pick, drop or paste them, before the site uploads them. It reads the text in them on your device: images with an OCR model and PDFs with a PDF reader, both bundled inside the extension. If you choose "Redact & attach", the redacted copy of an image is also made on your device.
So that "Redact & attach" can cover what text recognition can't read, Maskr also finds where an image shows a face (for example the photo on an ID card), a QR code or barcode, and a handwritten signature. It does this on your device, with a face-detection model and image analysis bundled inside the extension. It only finds where a face is so it can black it out: it does not recognise or identify anyone, does not compare faces, and keeps nothing about them. QR codes and barcodes are covered, never decoded.
A file Maskr finds nothing in is handed to the site unchanged, exactly as you chose it. While a file is being checked, its contents are held only in your browser's memory. So that attaching the same file again doesn't mean checking it again, Maskr keeps a fingerprint of each file it has checked (a one-way hash, from which the file cannot be recovered) and the result, in memory, until you close or reload the tab.
This text, and these files, are not transmitted anywhere by Maskr, stored on any server, shared with anyone, or used for any purpose other than checking them before you send them. File names are not recorded.
Maskr's notices show a hint of each detected value (for example 79••••••••73) so you can tell which one is meant. If you turn on Show full values in notices in Dashboard → Settings, they show the value in full instead. Either way the value is only shown on your screen, never stored.
What is stored, and where
Maskr stores the following only in your browser's own extension storage (chrome.storage.local) on your device:
| Item | What it contains |
|---|---|
| Alert history | For each warning or block, on a prompt or an attachment: the time, the website, whether it was an attachment and of what kind (image, PDF or text file, never its name), the kinds of data found (e.g. "Aadhaar number"), the rule that applied, and what happened (not sent, sent anyway, masked; for attachments, not attached, attached anyway, redacted). It never contains the detected values themselves. Up to the 2,000 most recent entries are kept. |
| Masked snippet (optional) | Up to 200 characters of a flagged prompt, or of the text read from a flagged attachment, with every detected value blacked out, so you can recognise it later. You can turn this off in Dashboard → Settings. |
| Your settings | Your rules, the extra sites you added, any pauses, the on/off switch, whether attachments are checked, whether notices show values in full, whether masked snippets are kept, and the Scanned / Blocked / Warned counters. |
None of this leaves your device. We cannot see it.
What Maskr does not do
- It does not send your prompts, your files, detections or history to any server, including ours. Maskr has no server.
- It does not use analytics, crash reporting, advertising or tracking of any kind.
- It does not sell, rent, share or transfer any data to third parties.
- It does not use data for any purpose unrelated to checking prompts and attachments, or to determine creditworthiness or for lending.
- It does not require an account or sign-in.
Permissions, in plain words
- Access to the supported AI chat sites: to check a prompt when you press send, and a file when you attach it, on those sites.
- Access to other sites (optional): only for a chat site you add yourself in the dashboard. Chrome asks you each time, one site at a time.
- Storage: to keep your settings and alert history on your device.
- Offscreen document: to run the bundled AI, OCR and face-detection models and the PDF reader in the background, locally.
- Scripting: to start checking on the extra sites you add.
- Active tab: so the toolbar popup can show whether the current site is being checked.
Your control over your data
- Clear alert history: Dashboard → Alerts → Clear history.
- Delete your alert history, rules and counters: Dashboard → Settings → Erase. Remove sites you added in Dashboard → Sites.
- Uninstalling Maskr removes all of its stored data from your browser.
- You can pause Maskr on any site, or switch it off, from the toolbar popup. You can stop it checking attachments in Dashboard → Settings → Check attachments.
Children
Maskr is not directed at children and collects no information from anyone.
Changes to this policy
If Maskr's handling of information ever changes, this page will be updated and the effective date above will change. Any change that would send data off your device would be stated here clearly before it takes effect.
- 4 October 2026 (version 1.1.1): "Redact & attach" now also covers faces, QR codes and barcodes, and signatures in an image, found on your device. Faces are located, never recognised or identified. Nothing about this sends any data anywhere; no new permissions are requested.
- 27 September 2026 (version 1.1.0): Maskr now also checks attached files, on your device, and can attach a redacted copy of an image. Nothing about this sends any data anywhere; no new permissions are requested.
- 20 September 2026: first version of this policy.
Contact
Questions about this policy: gwebstoredeveloper@gmail.com