A pencil drawing. Three panels of clear glass stand one behind the other along a path, which runs on into open light. Moss and a few young shoots grow at their foot.

TRANSPARENCY

Technical transparency

What each extension reads, what it stores, and where it connects.

This page covers the public Chrome Web Store editions. For Safe Privacy Mask Enterprise permissions, traffic and audit behavior, see its product page.

This is not a safety guarantee. Please make the final check yourself.

IN SHORT

Three things worth knowing first

Does anything I type get sent somewhere?

No. Neither what you type nor what a tool finds is sent to a developer server. The work happens inside your browser.

What gets stored?

It depends on the tool. Most store only settings, but these three also store information they work with.

Find My Age: the people you register (name and date of birth)
Copy & Prep: the passages you add from the right-click menu, with the page title and URL
Site Operator Check: the operator details read off the page (cleared when the browser restarts)

All of it is kept on the device and none of it is sent anywhere. The only thing that syncs to another device is Safe Night Check’s settings. What each tool stores is listed further down this page.

Can I check this myself?

Yes. The browser developer tools show the traffic an extension makes. The steps are further down this page.

This is a record from 16 August 2026. We built the eight extensions locally at the version numbers then on the store, loaded them into Chromium on Linux, and recorded network activity while opening their settings pages and popups. All 234 requests loaded files bundled with the extensions; none went to external servers. It did not cover the packages installed from the store or the extensions at work on real web pages, and all eight have published newer versions since.

An automated step in the build looks for networking APIs in the code being distributed. As of 2 October 2026, the source build of every one of the eight published versions includes this check. We have not confirmed that each package submitted to the store was produced by a build that ran it.

This is the result within what was tested, and not a guarantee of safety.

PRINCIPLES

Shared design principles

Runs on your device

Detection, checks and any text replacement run in your browser.

No external sending from the extensions

The extensions perform no server transmission, usage analytics, or telemetry. This website itself does use Google Analytics (see the site privacy policy).

Minimal permissions

Each tool requests only the permissions its features need.

You decide

Nothing is decided for you. Some tools pause an action, but whether to continue is yours to choose.

Free, and no account

All of them are free. There is no sign-up and no login, and no payment details are handled.

BY PRODUCT

Permissions, storage and traffic by product

chrome.storage.local

Data stays in this browser and is not synced to other devices. Removing the extension deletes it.

chrome.storage.sync

Chrome can sync this data to other devices signed in to the same Google account. Only Safe Night Check's settings use this storage.

chrome.storage.session

Temporary storage used while the browser is open. It is cleared on restart and is not saved to disk.

“No external traffic” on each card below means the extension itself sends nothing to the developer’s servers or to any external API. Chrome’s own sync (chrome.storage.sync) is a separate mechanism, and as noted above it carries only Safe Night Check’s settings.

Safe Privacy GateNo external traffic

Chrome API permissions: storage
host_permissions: <all_urls>
Where it runs: All sites, except ones you mark as trusted
What it reads: The text at the moment you send, and the names of files you pick (never rewritten; file contents are not read)
What is stored: Settings only (chrome.storage.local). Your text is not stored
External traffic: None
Analytics / telemetry: None
Main limits: Misses and false positives happen. A page can cover the confirmation dialog; this does not forcibly stop a send

Safe Privacy MaskNo external traffic

Chrome API permissions: storage · scripting
host_permissions: None (optional: <all_urls>, granted each time you add a site)
Where it runs: 15 major AI chat sites; others only when you add permission
What it reads: Text in the fields it covers (by default replaced per your rules while you type, on paste, when you leave the field and just before sending)
What is stored: Settings, rules and target sites (chrome.storage.local)
External traffic: None
Analytics / telemetry: None
Main limits: Does nothing in unsupported input fields. Misses and false positives happen

Safe Attachment CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: All sites, only when you pick or drop a file
What it reads: The contents of the file you pick, read on-device to show metadata (never sent or altered)
What is stored: Settings only (chrome.storage.local). File contents are not stored
External traffic: None (CSP sets connect-src 'none')
Analytics / telemetry: None
Main limits: JPEG, PNG, WebP, PDF, DOCX and XLSX only. Files over 45 MB, encrypted or password-protected files and iframe upload UIs are out of scope. Requires Chrome 116 or later

Safe Night CheckNo external traffic

Chrome API permissions: storage
host_permissions: https://mail.google.com/*
Where it runs: Gmail (mail.google.com) only
What it reads: Not the body, recipients, subject or attachments (it detects only the send action)
What is stored: Hours, days and ON/OFF: chrome.storage.sync. Pauses, migration and first-run state: chrome.storage.local (not synced).
External traffic: No developer uploads. Regular settings use Chrome’s own sync.
Analytics / telemetry: None
Main limits: Gmail only. Uses your device clock. Requires Chrome 116+

Safe Mail Link CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: Loaded on all sites. Acts on Gmail, Outlook on the web, Yahoo! Mail (Japan) and sites you add
What it reads: A clicked link’s URL and text, discarded at once
What is stored: Settings only (chrome.storage.local). No click history is kept
External traffic: None
Analytics / telemetry: None
Main limits: Outside the supported mail services, it does nothing until you add the site

Find My AgeNo external traffic

Chrome API permissions: storage
host_permissions: <all_urls>
Where it runs: All sites, only when you select a date
What it reads: Only the text you select, discarded at once. Never the page body or URL
What is stored: The people you register (name, birth date and so on) and settings (chrome.storage.local). Sync is not used
External traffic: None
Analytics / telemetry: None
Main limits: Does nothing unless the whole selection reads as a date. Dates before 1868 (Meiji 1) are out of scope. Results are for reference, not for official, medical or legal decisions

Copy & PrepNo external traffic

Chrome API permissions: contextMenus, storage, activeTab, scripting
host_permissions: None
Where it runs: Nothing runs continuously; only at the moment you use the right-click menu
What it reads: The passage you add from the right-click menu, plus that page’s title and URL. Page content is never scanned
What is stored: The passages you collect (text, page title, URL, time added) and your output settings (chrome.storage.local). Sync is not used
External traffic: None
Analytics / telemetry: None
Main limits: Tidying covers whitespace and line breaks only — no summarising, paraphrasing or proofreading. Collected passages are not synced

Site Operator CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: All http and https sites (top frame only). The panel appears only when you press the icon; on pages it identifies as a legal notice, terms, privacy policy or company page, it reads the operator information automatically when the page loads
What it reads: The footer, address elements, structured data, meta tags, links, the sources of embedded frames and scripts, and where forms declare they submit — plus the page body when the page itself is a legal notice or terms. Never field values, files, submissions, selections or the clipboard
What is stored: Only the operator information read from the site (chrome.storage.session, cleared when the browser restarts). What you do is never stored
External traffic: None (connect-src 'none' in the CSP)
Analytics / telemetry: None
Main limits: Makes no safety judgement. Does not verify that the statements are correct. Finding nothing does not mean a site is safe. Requires Chrome 116 or later

Checked 12 October 2026. We downloaded the packages the Chrome Web Store was distributing (Safe Privacy Gate 1.0.2, Safe Privacy Mask 1.0.1, Safe Attachment Check 1.0.1, Safe Night Check 1.0.2, Safe Mail Link Check 1.0.1, Find My Age 1.0.3, Copy & Prep 1.0.1, Site Operator Check 1.0.1) and compared the permission, storage and CSP rows with their manifest.json and code. The external-traffic row means no code that connects to outside servers was found; it is not an observation of network activity. Descriptions of behaviour are based on the code and each product’s documentation. Copy & Prep uses the scripting permission to read the selected text in the frame you right-clicked during an add operation. activeTab access need not expire immediately after the click and can continue on the same origin.

What changed in each tool is posted on News.

See the release history →

VERIFY

How to verify it yourself

Chrome itself lets you check both the traffic and the permissions.

Inspect permissions

Open chrome://extensions and click “Details” on an extension to see the permissions it requests.

Read how permission displays compare across seven Chrome extensions

Watch the traffic

Traffic from the extension itself (its service worker) does not show in the page’s DevTools. Use its own DevTools instead.

Open chrome://extensions and turn on “Developer mode” in the top right.
Click the “Service worker” link on the extension to open its dedicated DevTools (if it reads “Inactive”, clicking wakes it up).
Keep the Network tab of that dedicated DevTools open while you use the extension, and confirm that no external requests occur.
Traffic from content scripts running in the page shows in the page’s own DevTools (F12) → Network. For the popup or the options page, right-click inside it and choose “Inspect”.

Chrome’s official extension debugging guide

Traffic limited by the CSP

Attachment / Night / Site Operator Check declare connect-src 'none' in the CSP in manifest.json. Network connections from those extension pages are blocked by the browser.

LIMITS

Known limits

These are not security products

None of them is a DLP, an antivirus or a phishing detector. Nothing here decides whether something is dangerous, and nothing here can force a send or a page to stop. They are not a replacement for the measures you already have.

Detection is not complete

Misses and false positives both happen. Finding nothing does not mean there was nothing to find.

The scope differs by product

Supported sites, file types and browser requirements are not the same for every tool. See the table above and each product page.

An update can change this

Updating an extension can change the permissions it asks for or what it stores. The date this page was last checked is under the per-product list.

For details on each product, see its product page and privacy policy.

Who makes these is set out on a page of its own.

About Legacy Tools →