I built PrivyPrompt, a local-first privacy guard for AI prompts

Kirti kant Pareek — Sun, 02 Aug 2026 08:55:12 +0000

Developers are pasting more into AI tools every day.

Logs. Stack traces. .env files. API responses. SQL errors. Customer notes. Contracts. PDFs. Screenshots. Internal docs.

That workflow is useful, but it also creates a quiet privacy risk:

What if the prompt contains an API key?

What if a file includes customer data?

What if a screenshot has sensitive information nobody noticed?

I built PrivyPrompt to help reduce that accidental sharing.

What PrivyPrompt does

PrivyPrompt is a Chrome extension that checks prompts and supported files before they are submitted to AI tools.

It can warn, mask, or block sensitive content like:

API keys, tokens, JWTs, private keys, and database URLs
Password-like values and custom protected terms
Emails, phone numbers, credit cards, and IBANs
National identifiers and country-specific ID formats
Sensitive business, healthcare, finance, legal, and HR-style data
Risky AI instructions such as prompt-injection or secret-exfiltration wording

It also supports local checks for files like text, code, .env
, config, CSV, JSON, Markdown, SQL, logs, PDFs, DOCX files, and clear screenshots.

Local-first by design

I did not want to build a tool where users upload sensitive content just to check if the content is sensitive.

So PrivyPrompt works locally inside the browser.

No account.

No telemetry.

No PrivyPrompt upload endpoint.

Prompt text, extracted file text, OCR text, custom terms, and temporary alias mappings stay on the user's device. The AI website receives only what the user approves.

How masking works

If PrivyPrompt detects something risky, the user can choose what to do with it.

For example, a real secret can be replaced with a session-only alias:

demo@gmail.com => [PP_SECRET_1]
This lets the AI tool understand the structure of the request without receiving the original sensitive value.
Why I built it
Most AI privacy mistakes are not intentional.
They happen because someone is moving fast.
A developer pastes a log.
A freelancer uploads a client document.
A support person summarizes customer notes.
A founder asks AI to review a contract.
PrivyPrompt is meant to be a lightweight review layer before that final submit.
It is not a compliance certification tool, and it does not guarantee complete protection. It is a practical privacy aid that helps users catch obvious and high-risk mistakes before sending content online.
Current status

PrivyPrompt v1.0 is now published on the Chrome Web Store.
The current focus is:
Getting feedback from real AI-tool users
Improving detection quality
Making the review flow clearer
Keeping the extension local-first
Exploring a future Teams/SaaS version
The longer-term idea is PrivyPrompt Teams: a version for companies that want policies, custom rules, privacy-safe reporting, and admin controls for AI usage.
Who this is for
PrivyPrompt may be useful if you:
Use AI tools while coding
Paste logs, stack traces, or config snippets into AI chats
Work with client data, support data, contracts, or internal docs
Upload screenshots or files to AI tools
Want a local safety check before sending sensitive content online
I would love feedback
I am sharing this early because I want feedback from developers, freelancers, security-conscious users, and teams adopting AI tools.
A few things I am trying to learn:
Which sensitive data types matter most in your workflow?
Should the extension be stricter by default or more lightweight?
Which AI workflows create the most privacy risk?
Would a Teams version be useful for your company?
What would make you trust a tool like this?
You can try PrivyPrompt here:
Chrome Web Store: https://chromewebstore.google.com/detail/privyprompt-privacy-firew/hkpfbehbdjaaoohpdacbiepdccmpcnmp
Website: https://kk-092.github.io/PrivyPrompt/

DEV Community: Kirti kant Pareek

I built PrivyPrompt, a local-first privacy guard for AI prompts