MaskPrompt Privacy Policy

Last updated: June 2026

MaskPrompt is a Chrome browser extension that automatically detects and redacts personally identifiable information (PII) from your prompts before they are sent to AI platforms. This policy explains what data MaskPrompt handles and how it is used.

Data processed on-device (never leaves your browser)

Your AI prompt content is scanned locally for PII patterns (emails, phone numbers, credit card numbers, Social Security numbers, IP addresses, and API keys).
Detected PII is replaced with reversible placeholder tokens before submission to the AI platform.
The placeholder-to-original mapping is stored in your browser's session storage and is automatically cleared when you close the tab.

Data transmitted to MaskPrompt's servers

To enforce usage limits and validate Pro licenses, the extension transmits the following to MaskPrompt's API (hosted on Cloudflare Workers):

Anonymous install identifier

A browser-generated identifier (chrome.runtime.id) used solely to associate usage counters and license status with your installation. This identifier is random, does not contain personal information, and changes if the extension is reinstalled.

Redaction counts

Numeric counters (e.g., "3 total redactions, 1 API key redaction") are transmitted to enforce the free-tier daily limit of 15 redactions. These are anonymous numbers only — no prompt content, PII values, or identifying information is included.

License validation (Pro users only)

A cryptographic hash (SHA-256) of your license key is stored to validate Pro subscription status. The raw license key is never stored on our servers.

Data we never collect

Your prompt text or any redacted PII content
Your IP address
Your browsing history or pages visited
Your name, email address, or any personal identity
Any form of personally identifiable information

Third-party services

Lemon Squeezy — processes Pro license payments. See their privacy policy.
Cloudflare Workers & Turso — host the anonymous counter API and database. See Cloudflare's privacy policy.

Data retention

Usage counters are retained per calendar day and reset at midnight UTC. Historical daily counts are automatically purged after 48 hours.
License validation records are retained for the duration of the license validity and deleted upon expiration or cancellation.
Pending license keys (from un-claimed purchases) are automatically purged after 7 days.

Your rights

Since MaskPrompt does not collect any personal data, there is no personal data to access, modify, delete, or export. All PII processing happens entirely on your device. To erase all extension data, uninstall the extension from Chrome — no data remains on our servers tied to your identity.

Contact

For questions about this privacy policy, contact support.