Stop pasting secrets into ChatGPT & other AI chats.

Open Chrome DevTools → Network tab → filter by the extension ID. Paste anything sensitive. You'll see zero outbound requests. Our manifest declares no host_permissions for any remote origin. Only the 8 AI chat sites the content script runs on, and we never send their contents anywhere. The detection rules are published at github.com/Matteo-Coder2/pasteguard-rules so you can audit exactly what we look for.

Cold-start payload is 44 KB (14 KB gzipped). Detection runs in under 20 ms on a typical paste. The modal's React tree only loads when a finding actually triggers. Most pastes pay zero cost. We hook the paste event at the document level (not site-specific selectors), so when ChatGPT redesigns their UI, PasteGuard keeps working.

The core (18 detectors, all 8 sites) is free forever. Not a 14-day trial. We make money from Pro ($4.99/mo) which adds the modern AI-vendor key detectors and the on-device semantic layer. We literally cannot sell your data because nothing leaves your device. No telemetry, no analytics, no account required. Full stop.

Those are enterprise tools sold with annual contracts. Most importantly: they're cloud DLP. To classify your text they route it to their servers, which means your secret is now in two places instead of one. PasteGuard is on-device, no contract, designed for the individual worker without a corporate IT department. We're not the right tool for SOC2-compliant orgs; for everyone else we're more truthful about the privacy model.

Out of scope for v0.1. PasteGuard intercepts paste, typed-text-then-Enter, and Send-button clicks. If you drag a screenshot of a customer dashboard into ChatGPT, we don't scan the image. If you dictate a customer name via voice, we never see it. If you attach a PDF, it goes straight to the AI service. We're a smart safety net for keyboard/clipboard input. Not a full compliance product. Combine with judgment.

Out of the box, the 25 built-in detectors cover the universal "secret-shaped" things: API keys, SSNs, credit cards, IBANs, PEM keys, etc. For industry-specific patterns. Medical record numbers, court case IDs, employee codes, CUSIP/ISIN security IDs. You add a custom regex rule in Options. The live tester verifies the pattern before saving. For HIPAA/SOX/GLBA compliance you still need a real DLP; PasteGuard is a personal safety net, not a compliance certification.

Grok opens as a sidebar inside x.com that can appear on any URL (a tweet, a profile, the timeline). To protect that sidebar, the content script has to load on every x.com page. But the actual scanning is gated to composers with Grok-specific markers. Tweet drafts and reply boxes are explicitly ignored. We never read their contents. The full caveat is in our privacy policy.

Click "Add to allowlist" on the row once. We won't flag that exact text again on any site. Or click "Ignore for this session" for a one-tab pass. There's no nag, Pro is mentioned once in the Options page and never interrupts a paste flow.

It requires Chrome 138+ and either a discrete GPU with more than 4 GB VRAM, or 16+ GB of RAM with a modern CPU. About 22 GB of free disk is also needed for Chrome's local AI model. On unsupported hardware, the 25 regex detectors still work. Only the AI-based detectors (customer name, codename, confidential signal) degrade. The extension is honest about which detectors are unavailable on your machine.

The detection rules are MIT-licensed and live in a public GitHub repo. They survive us. The extension binary lives on Chrome Web Store and stops getting updates if we abandon it; you can still use the last-published version. We have no plans to sell to a data-mining company; if that ever changes, the rules repo is the fork-friendly escape hatch.

Yes. Managed Chrome installations can list installed extensions by ID. We don't hide. If your organization has an extension allowlist and PasteGuard isn't on it, ask IT to add the extension ID. We're not designed for stealth use against employer policy.