This policy describes the PromptMask browser extension, which masks selected sensitive details in AI chat prompts. It covers the current extension implementation, not the separate product landing page or your chosen chat provider.
PromptMask runs Gemma inference on your device using MediaPipe and WebGPU. Its redaction code does not send prompts to a cloud inference service. The model is downloaded from Hugging Face and its delivery hosts when it is not available in the browser cache. Those providers receive ordinary network metadata associated with the download, such as your IP address and request details.
The browser Cache API stores model files. Chrome local storage stores site and category settings and model download/loading progress and status. The extension does not maintain a prompt-history database. It requests persistent storage, but the browser may deny persistence or clear cached data, requiring another model download.
The current extension logs the framed model prompts, raw model results, and normalized output to the extension's developer console. These logs can contain sensitive text and may remain in the console while its session or log preservation is active. Avoid sharing console exports or screenshots that contain private information.
Your draft is typed into the chat site's composer. Scripts on that page can read it before PromptMask intercepts submission. Local model inference does not prevent the site from observing the original draft.
On enabled sites, PromptMask intercepts submission, places the redacted result in the composer, and asks you to review and submit again. The message you then submit goes to your chosen chat provider under that provider's policies. Masking can miss sensitive details, and disabled sites or categories allow corresponding information to remain. Review the full message before sending it.
For implementation details, see the PromptMask source repository. Gemma is provided under and subject to the Gemma Terms of Use.
Contact: nidhi@aer.app