PromptGuardian · Last updated August 24, 2026 (local storage list expanded to name the cached file rules and device identifier)

Overview

PromptGuardian is a data-loss prevention tool for businesses. It helps an organization prevent its own confidential information from being pasted into AI chat tools and other websites. This policy explains what the browser extension and the web dashboard collect, how that data is used, and how it is stored.

Who we are

PromptGuardian is provided by Jake Team LLC ("Jake Team", "we", "us", or "our"). Our mailing address is PO Box 1417, Prosper, TX 75078, United States. For purposes of applicable privacy laws, Jake Team LLC is the entity responsible for the processing described in this policy.

This policy is governed by the laws of the State of Texas, United States, without regard to conflict-of-laws rules.

What we do NOT collect

We never transmit or store the content you type. Keyword matching happens entirely inside your browser. Your prompts, messages, documents, and form contents are never sent to our servers.

We never transmit or store the files you attach. When your organization enables file checking, files are inspected on your own device before any upload begins. File contents are never uploaded to us.

We do not collect browsing history. Simply visiting a site — even a monitored one — reports nothing to us. There is no record of the pages you open, and the extension contains no advertising or analytics trackers.

We do not record URLs. When one of your organization’s rules is triggered, the event records the site’s domain name only (for example chatgpt.com). We never store the full web address, the part after the domain, search terms, or the page title. Sites where nothing matched are never mentioned in any event.

What the extension stores locally

Saved in your browser’s local extension storage, on your device only:

• Your organization’s extension key
• The API URL the extension syncs with
• A cached copy of your organization’s policy (protected keywords, monitored sites, and file upload rules)
• The random device identifier and the short device code described under Device identification
• The timestamp of the last successful sync, and the last sync error if one occurred

What the extension sends to our servers

When a policy rule matches, the extension reports an event so administrators can see that a policy was triggered. Each event contains only:

• Which keyword rule matched (by internal ID — not the surrounding text)
• The domain where it occurred (for example, chatgpt.com)
• The rule mode (block or audit)
• The outcome (replaced, confirmed_send, or cancelled_send)
• A timestamp
• The device code of the browser that reported it (see Device identification below)

The matched text itself, and the message it appeared in, are never included in these events.

Because each event carries a device code, an administrator can see which browser triggered a rule and review that browser’s history. If your administrator has labelled that device with your name, events are identifiable to you.

File upload events

If your organization has enabled file checking, an event is reported when a file is refused or warned about. Each such event contains only:

• The file extension (for example xlsx)
• The file size in bytes
• Why it was flagged (upload policy, file type, size limit, or a keyword rule)
• The domain, and whether the user proceeded or cancelled
• The device code of the browser that reported it

Filenames are not recorded by default. An administrator may opt in to recording them, because a filename can itself be revealing. The contents of a file are never recorded regardless of that setting.

Files are inspected locally. Text-based formats may be read into memory on your device to check them against your organization’s keyword rules; that text is discarded immediately and never leaves the browser.

Device identification

So administrators can see how many installs are in use and shut off a lost or decommissioned machine, the extension generates a random identifier the first time it runs and sends it when syncing policy. Alongside it we record only the operating system family (for example Windows) and the browser name and major version (for example Chrome 140).

This is not a device fingerprint. The identifier is a random value, not derived from your hardware, and it is not shared between organizations or used to recognize you anywhere else. We do not read your computer name, serial number, MAC address, or any hardware identifier — a browser extension cannot access those, and we do not attempt to reconstruct them from other signals.

We also assign each install a short device code (for example K7M4QP), which is shown in the extension’s popup. It exists so you can tell your administrator which browser is yours without us collecting your computer name or username. This code is attached to the events described above, and an administrator may add their own label to it.

Because the identifier lives in browser storage, clearing your browsing data or using a new browser profile produces a new identifier and a new code.

Account data (dashboard)

Administrators who create an account provide an email address, a password, and a company name. Authentication is handled by Supabase; passwords are hashed and we never have access to them in plain text.

Organizations also store the policy they define: protected keywords or patterns, their replacement text, the list of monitored domains, and their file upload rules.

Site access permissions

The extension requests broad site access because each organization defines its own list of monitored sites, which is not known at install time and can change at any moment. The extension only enforces policy on the domains your administrator has configured; on all other sites it takes no action.

Data storage and retention

Data is stored in Supabase (PostgreSQL) with row-level security enabled, and served through infrastructure hosted on Vercel. All traffic is encrypted in transit over HTTPS.

Policy data and event records are retained while your organization’s account is active. Deleting your organization removes its keywords, monitored domains, and event records.

Data sharing

We do not sell your data. We do not share it with advertisers. Data is disclosed only to the infrastructure providers required to operate the service (Supabase for the database and authentication, Vercel for hosting), or where required by law.

Your rights

Administrators can view, edit, and delete their organization’s keywords, monitored domains, file rules, and registered devices from the dashboard at any time, and can regenerate the extension key to revoke access from previously configured browsers.

Event records are retained as an audit trail and are not individually deletable from the dashboard; removing a device does not erase the events it already reported. To request deletion of specific records, or of your account and all associated data, contact us at the address below.

Changes to this policy

If this policy changes materially, we will update the date at the top of this page and notify account administrators by email.

Contact

Jake Team LLC
PO Box 1417
Prosper, TX 75078
United States

Privacy questions about this policy or your data: privacy@techharbor.ai