Privacy Policy

Last updated: September 2026

The short version: ShadowGuard runs entirely on your device. It does not have a server, does not collect analytics, and does not see or store the contents of your prompts anywhere except your own browser. The one exception — activating a paid license — is explained below in full.

What ShadowGuard is

ShadowGuard is a Chrome extension that scans text you're about to send to ChatGPT, Claude or Gemini for secrets, credentials and personal data, and can redact or block it before it's sent. All scanning happens locally, in your browser, using on-device pattern matching — no text is transmitted to any server for analysis.

What we store, and where

Everything below is stored only in your own browser's local extension storage (chrome.storage.local), never on any external server:

Your policy settings — which categories you've set to Allow, Warn, Redact or Block, and any custom terms you've added.
A minimized activity log — just the category and action of things ShadowGuard caught (e.g. "email — redacted"), never the actual sensitive value, so you can review what it's done.
A license record — your trial start date, and if activated, your license key, activation ID, and the email associated with your purchase.

The actual sensitive values ShadowGuard redacts (e.g. a real email address behind a [EMAIL_1] placeholder) are held only in memory for the current browser tab's session, so a response from the AI can be shown with real values restored. This mapping is never written to disk and disappears when you close or refresh the tab.

What's ever sent outside your browser

Exactly one thing: when you activate, deactivate, or ShadowGuard periodically re-checks a license, your license key (and nothing else — no prompt text, no detected values, no browsing activity) is sent to Lemon Squeezy, our payment and licensing provider, to verify it's valid. This only happens when you've entered a license key yourself; it never happens automatically for the free trial. See Lemon Squeezy's own privacy policy for how they handle that data.

ShadowGuard does not use analytics, telemetry, crash reporting, or any third-party tracking script. There is no ShadowGuard server receiving data from your browser at all.

Why ShadowGuard requests the permissions it does

Site access to chatgpt.com, chat.openai.com, claude.ai and gemini.google.com — required to read the prompt box's text at the moment you submit, and to rewrite it in place when redacting. ShadowGuard does not request access to any other website.
Site access to api.lemonsqueezy.com — required only to make the license activation/validation request described above.
storage — required to save your settings and activity log locally, as described above.

Data you can delete

Uninstalling the extension removes all locally stored data immediately. You can also clear your activity log and custom terms at any time from the extension's options page, and deactivate a license from the same page (which also releases that device's activation slot on our end).

Children's privacy

ShadowGuard is not directed at children and does not knowingly collect data from children under 13.

Changes to this policy

If this policy changes, the updated version will be posted at this same URL with a revised "Last updated" date.

Contact

Questions about this policy or how ShadowGuard handles data: baigahmad323@gmail.com.