Developers are pasting more into AI tools every day.
Logs. Stack traces. .env files. API responses. SQL errors. Customer notes. Contracts. PDFs. Screenshots. Internal docs.
That workflow is useful, but it also creates a quiet privacy risk:
What if the prompt contains an API key?
What if a file includes customer data?
What if a screenshot has sensitive information nobody noticed?
I built PrivyPrompt to help reduce that accidental sharing.
What PrivyPrompt does
PrivyPrompt is a Chrome extension that checks prompts and supported files before they are submitted to AI tools.
It can warn, mask, or block sensitive content like:
- API keys, tokens, JWTs, private keys, and database URLs
- Password-like values and custom protected terms
- Emails, phone numbers, credit cards, and IBANs
- National identifiers and country-specific ID formats
- Sensitive business, healthcare, finance, legal, and HR-style data
- Risky AI instructions such as prompt-injection or secret-exfiltration wording
It also supports local checks for files like text, code, .env
, config, CSV, JSON, Markdown, SQL, logs, PDFs, DOCX files, and clear screenshots.
Local-first by design
I did not want to build a tool where users upload sensitive content just to check if the content is sensitive.
So PrivyPrompt works locally inside the browser.
No account.
No telemetry.
No PrivyPrompt upload endpoint.
Prompt text, extracted file text, OCR text, custom terms, and temporary alias mappings stay on the user's device. The AI website receives only what the user approves.
How masking works
If PrivyPrompt detects something risky, the user can choose what to do with it.
For example, a real secret can be replaced with a session-only alias:
demo@gmail.com => [PP_SECRET_1]
This lets the AI tool understand the structure of the request without receiving the original sensitive value.
Why I built it
Most AI privacy mistakes are not intentional.
They happen because someone is moving fast.
A developer pastes a log.
A freelancer uploads a client document.
A support person summarizes customer notes.
A founder asks AI to review a contract.
PrivyPrompt is meant to be a lightweight review layer before that final submit.
It is not a compliance certification tool, and it does not guarantee complete protection. It is a practical privacy aid that helps users catch obvious and high-risk mistakes before sending content online.
Current status
PrivyPrompt v1.0 is now published on the Chrome Web Store.
The current focus is:
Getting feedback from real AI-tool users
Improving detection quality
Making the review flow clearer
Keeping the extension local-first
Exploring a future Teams/SaaS version
The longer-term idea is PrivyPrompt Teams: a version for companies that want policies, custom rules, privacy-safe reporting, and admin controls for AI usage.
Who this is for
PrivyPrompt may be useful if you:
Use AI tools while coding
Paste logs, stack traces, or config snippets into AI chats
Work with client data, support data, contracts, or internal docs
Upload screenshots or files to AI tools
Want a local safety check before sending sensitive content online
I would love feedback
I am sharing this early because I want feedback from developers, freelancers, security-conscious users, and teams adopting AI tools.
A few things I am trying to learn:
Which sensitive data types matter most in your workflow?
Should the extension be stricter by default or more lightweight?
Which AI workflows create the most privacy risk?
Would a Teams version be useful for your company?
What would make you trust a tool like this?
You can try PrivyPrompt here:
Chrome Web Store: https://chromewebstore.google.com/detail/privyprompt-privacy-firew/hkpfbehbdjaaoohpdacbiepdccmpcnmp
Website: https://kk-092.github.io/PrivyPrompt/
Top comments (0)