TRANSPARENCY
Technical transparency
What each extension does — and does not do. Permissions, data handling, and external communication, explained so you can verify.
This page explains technical facts; it is not a safety guarantee. Detection can miss things or misfire. Please do the final check yourself.
IN SHORT
Three questions, answered first
Does anything I type get sent somewhere?
No. None of the eight has any way to send what you type, or what it finds, to a developer server. The checking finishes inside your browser.
What gets stored?
Your settings, in most cases. There are two exceptions: Find My Age keeps the birth dates you register, and Copy & Prep keeps the text you collect. Both stay on this device and are not synced to your other devices.
Can I check this myself?
Yes. The browser developer tools show the traffic an extension makes, as it happens. The steps are further down this page.
All eight — at the same versions as the ones on the store — were loaded into a browser with the settings page and the popup opened: all 234 requests recorded were the extension reading a file bundled inside itself, and none went outside. All eight also have a machine check that scans the shipped code for networking APIs on every build (for some, it takes effect from their next release). This is the result within what was tested, and not a guarantee of safety.
PRINCIPLES
Principles shared by all eight
Runs on your device
Detection, evaluation, and (where applicable) replacement all happen inside your browser.
No external sending from the extensions
The extensions perform no server transmission, usage analytics, or telemetry. This website itself does use Google Analytics (see the site privacy policy).
Minimal permissions
Each tool requests only the minimum permissions it needs.
You decide
Nothing is sent or forbidden on your behalf. Night pauses a send and, once you confirm, sends it for you. Gate also pauses the send but never re-sends on your behalf — continuing is your own action. Mask replaces text just before sending, Attachment only shows information without stopping the upload, and Mail Link Check shows a link’s destination before it opens without ever opening it for you. Find My Age answers only the date you selected and never annotates the dates on a page on its own. Copy & Prep holds only the passages you added from the right-click menu, and tidies them only after showing you the before and the after and only once you press apply. Site Operator Check only steps in when you press the icon; it forbids nothing and judges nothing about whether a site is safe. The decision always stays with you.
BY PRODUCT
Permissions & scope by product
Details are based on the current product copy and privacy policies.
| Aspect | Safe Privacy Gate | Safe Privacy Mask | Safe Attachment Check | Safe Night Check | Safe Mail Link Check | Find My Age | Copy & Prep | Site Operator Check |
|---|---|---|---|---|---|---|---|---|
| Chrome API permissions | storage | storage · scripting | storage | storage | storage | storage | contextMenus, storage, activeTab | storage |
| Where it runs on sites | All sites (except ones you mark as trusted) | 15 major AI chat sites. Other sites only when you add permission yourself | All sites (acts only when you pick a file) | Gmail (mail.google.com) only | Loaded on all sites; acts on Gmail, Outlook on the web, Yahoo! Mail (Japan), and sites you add | All sites (acts only when you select a date) | Nothing runs continuously. It touches a tab only at the moment you use the right-click menu | Every site (top frame only; the panel appears only when you press the toolbar icon) |
| host_permissions | <all_urls> | None | None | https://mail.google.com/* | None | <all_urls> | None | None |
| optional_host_permissions | None | <all_urls> (you are asked to grant it each time you add a site) | None | None | None | None | None | None |
| What is stored | Settings only (chrome.storage.local; your text is not stored) | Settings · rules · target sites (chrome.storage.local) | Settings only (chrome.storage.local; file contents not stored) | Settings live in chrome.storage.sync (Chrome’s own sync may copy them to your other devices signed in to the same Google account). Only the first-run guide flag is in chrome.storage.local | Settings only (chrome.storage.local; no click history is kept) | The people you registered (display name, birth date, colour, order, visibility) and settings (chrome.storage.local; synced chrome.storage.sync is deliberately not used, so birth dates never leave the device) | The passages you collected (selected text, edited text, page title, URL, time added) and your output settings (chrome.storage.local; synced chrome.storage.sync is not used) | Only the operator information read from the site's own legal notice, terms, privacy policy or company page (chrome.storage.session, cleared when the browser restarts; per origin, at most 30 origins, at most 64KB each). What you do is never stored |
| External traffic | None | None | None (CSP sets connect-src 'none'; CI mechanically scans for networking code) | None (CSP sets connect-src 'none'; CI mechanically scans for networking code) | None | None | None | None (connect-src 'none' in the CSP) |
| Analytics / telemetry | None | None | None | None | None | None | None | None |
| Text / file handling | Reads about-to-send text and file names to detect (never rewrites) | Reads about-to-send text and replaces it per your rules | Reads the selected file’s contents on-device to show metadata (no sending/altering) | Never reads body, recipients, subject, or attachments (only detects the send action) | Reads only a clicked link’s URL and text, then discards them at once (no rewriting, no auto-open) | Reads only the selected text, decides whether it reads as a date, then discards it at once (never reads page body or URL) | Stores only what you explicitly add from the right-click menu (no content script, page content is never scanned). activeTab is used at that moment alone, to read the tab’s title and URL | Never touches a field's value, files, submission data, the selection or the clipboard. It reads the footer, address elements, structured data, meta tags and links — and the page body only when the page itself is a legal notice, terms, privacy policy or company page |
| Main limits | Misses and false positives happen. A page could technically cover the confirmation dialog — this does not forcibly stop a send | Does not work in unsupported input fields. Misses and false positives happen | Supports JPEG, PNG, WebP, PDF, DOCX, and XLSX only. Files over 45 MB, encrypted/password-protected files, and iframe-embedded upload UIs are out of scope | Gmail only. Uses your device clock and requires Chrome 116+ | Outside the supported mail services, it does nothing until you add the site yourself | Does nothing unless the whole selection reads as a date. Dates before 1868 (Meiji 1) are out of scope. Results are guidance, not for official, medical, or legal decisions | “Tidy up” only fixes whitespace and line breaks — it never summarises, paraphrases, proofreads, or builds academic citations. Collected passages are not synced, so they do not carry over to another device or browser | It makes no safety judgement. It neither proves that a company exists nor verifies that the statements are correct, and finding nothing does not mean a site is safe. It never watches your typing, so it cannot warn you or stop anything. The other origins it lists are what the page loads, which is not necessarily where your input goes |
VERIFY
How to verify it yourself
Inspect permissions
Open chrome://extensions, click “Details” on each extension, and review the permissions it requests.
Watch the traffic
Traffic from the extension itself (its service worker) does not show in the page’s DevTools, so use these steps to inspect the extension’s own traffic directly.
- Open chrome://extensions and turn on “Developer mode” in the top right.
- Click the “Service worker” link on the extension to open its dedicated DevTools (if it reads “Inactive”, clicking wakes it up).
- Keep the Network tab of that dedicated DevTools open while you use the extension, and confirm that no external requests occur.
- Traffic from content scripts running in the page shows in the page’s own DevTools (F12) → Network. For the popup or the options page, right-click inside it and choose “Inspect”.
Excluded by design
Attachment / Night / Site Operator Check declare connect-src 'none' in the CSP in manifest.json, which forbids network connections from the extension pages outright. It is a declaration, so the browser enforces it — you never have to read the code.
These steps let you confirm for yourself that the extensions send nothing externally.
LIMITS
Known limits
The limits of a helper tool are listed here as well.
Detection is not complete
Misses and false positives can happen. This is not a safety guarantee — please make the final check before you send.
Out of scope for Attachment
Files over 45 MB, encrypted/password-protected files, and iframe-embedded upload UIs are not analyzed.
Night’s requirements
Works only on Gmail (mail.google.com) and uses your device clock. Chrome 116+ is required.
For details on each product, see its product page and privacy policy.