Security & Privacy Policy

SafePaste was built on the principle that your data should never leave your RAM.

1. Data Residency

• No Server-Side: There is no backend. No data is sent to gautamjkr.github.io or any other domain.
• In-Memory Only: The "Ghost Map" (the link between <PHONE_1> and +1-555...) exists only in the volatile memory of the content script. Once the page is refreshed or the tab is closed, the map is destroyed.

2. Minimal Permissions

We adhere to the Principle of Least Privilege:

• Host Permissions: Limited strictly to chatgpt.com and gemini.google.com. The extension cannot read your data on bank sites, social media, or other sensitive pages.
• Clipboard Access: Only triggered on the specific SafePaste shortcut.

3. Local-First Auditing

All detection logic is contained in src/piiDetector.ts. We use no external NPM libraries for the detection itself to prevent Supply Chain Attacks.