A pencil drawing. Three panels of clear glass stand one behind the other along a path, which runs on into open light. Moss and a few young shoots grow at their foot.

TRANSPARENCY

Technical transparency

What each extension reads, what it stores, and where it connects.

This is not a safety guarantee. Please make the final check yourself.

IN SHORT

Three things worth knowing first

Does anything I type get sent somewhere?

No. Neither what you type nor what a tool finds is sent to a developer server. The work happens inside your browser.

What gets stored?

It differs by tool. Most store only your settings, but these three keep the material they handle.

Find My Age: the people you register (name and date of birth)
Copy & Prep: the passages you add from the right-click menu, with the page title and URL
Site Operator Check: the operator details read off the page (cleared when the browser restarts)

All of it is kept on the device and none of it is sent anywhere. The only thing that syncs to another device is Safe Night Check’s settings. What each tool stores is listed further down this page.

Can I check this myself?

Yes. The browser developer tools show the traffic an extension makes. The steps are further down this page.

The same versions as the ones on the store were loaded into a browser, the settings page and the popup were opened, and the traffic was recorded. All 234 requests were the extension reading a file bundled inside itself. None went outside.

Every build is machine-checked for networking APIs in the code that ships. The check was added to each tool at a different point, though, so not every published version has been through it.

This is the result within what was tested, and not a guarantee of safety.

PRINCIPLES

Shared design principles

Runs on your device

Detection and evaluation happen inside your browser. So does replacement, where a tool does that.

No external sending from the extensions

The extensions perform no server transmission, usage analytics, or telemetry. This website itself does use Google Analytics (see the site privacy policy).

Minimal permissions

Each tool requests only the permissions its features need.

You decide

Nothing is decided for you. Some tools pause an action, but whether to continue is yours to choose.

Free, and no account

All of them are free. There is no sign-up and no login, and no payment details are handled.

BY PRODUCT

Permissions, storage and traffic by product

chrome.storage.local

Stays inside that one browser. It does not travel to your other devices, and it goes when the extension is removed.

chrome.storage.sync

The area Chrome carries between devices. It can appear on any other device signed in to the same Google account. The only thing kept here is Safe Night Check’s settings.

chrome.storage.session

A scratch area that lasts only while the browser is open. It is gone on restart and never reaches the disk.

“No external traffic” on each card below means the extension itself sends nothing to the developer’s servers or to any external API. Chrome’s own sync (chrome.storage.sync) is a separate mechanism, and as noted above it carries only Safe Night Check’s settings.

Safe Privacy GateNo external traffic

Chrome API permissions: storage
host_permissions: <all_urls>
Where it runs: All sites, except ones you mark as trusted
What it reads: The about-to-send text and file names (never rewritten)
What is stored: Settings only (chrome.storage.local). Your text is not stored
External traffic: None
Analytics / telemetry: None
Main limits: Misses and false positives happen. A page can cover the confirmation dialog; this does not forcibly stop a send

Safe Privacy MaskNo external traffic

Chrome API permissions: storage · scripting
host_permissions: None (optional: <all_urls>, granted each time you add a site)
Where it runs: 15 major AI chat sites; others only when you add permission
What it reads: The about-to-send text (replaced per your rules)
What is stored: Settings, rules and target sites (chrome.storage.local)
External traffic: None
Analytics / telemetry: None
Main limits: Does nothing in unsupported input fields. Misses and false positives happen

Safe Attachment CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: All sites, only when you pick a file
What it reads: The contents of the file you pick, read on-device to show metadata (never sent or altered)
What is stored: Settings only (chrome.storage.local). File contents are not stored
External traffic: None (CSP sets connect-src 'none')
Analytics / telemetry: None
Main limits: JPEG, PNG, WebP, PDF, DOCX and XLSX only. Files over 45 MB, encrypted or password-protected files and iframe upload UIs are out of scope

Safe Night CheckNo external traffic

Chrome API permissions: storage
host_permissions: https://mail.google.com/*
Where it runs: Gmail (mail.google.com) only
What it reads: Not the body, recipients, subject or attachments (it detects only the send action)
What is stored: Settings (chrome.storage.sync — Chrome may copy them to your other devices on the same Google account). The only other thing kept is a flag recording whether the welcome screen has been shown, in chrome.storage.local (not synced)
External traffic: None (CSP sets connect-src 'none')
Analytics / telemetry: None
Main limits: Gmail only. Uses your device clock. Requires Chrome 116+

Safe Mail Link CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: Loaded on all sites. Acts on Gmail, Outlook on the web, Yahoo! Mail and sites you add
What it reads: A clicked link’s URL and text, discarded at once
What is stored: Settings only (chrome.storage.local). No click history is kept
External traffic: None
Analytics / telemetry: None
Main limits: Outside the supported mail services, it does nothing until you add the site

Find My AgeNo external traffic

Chrome API permissions: storage
host_permissions: <all_urls>
Where it runs: All sites, only when you select a date
What it reads: Only the text you select, discarded at once. Never the page body or URL
What is stored: The people you register (name, birth date and so on) and settings (chrome.storage.local). Sync is not used
External traffic: None
Analytics / telemetry: None
Main limits: Does nothing unless the whole selection reads as a date. Dates before 1868 (Meiji 1) are out of scope. Results are for reference, not for official, medical or legal decisions

Copy & PrepNo external traffic

Chrome API permissions: contextMenus, storage, activeTab
host_permissions: None
Where it runs: Nothing runs continuously; only at the moment you use the right-click menu
What it reads: The passage you add from the right-click menu, plus that page’s title and URL. Page content is never scanned
What is stored: The passages you collect (text, page title, URL, time added) and your output settings (chrome.storage.local). Sync is not used
External traffic: None
Analytics / telemetry: None
Main limits: Tidying covers whitespace and line breaks only — no summarising, paraphrasing or proofreading. Collected passages are not synced

Site Operator CheckNo external traffic

Chrome API permissions: storage
host_permissions: None
Where it runs: All sites (top frame only, and only when you press the icon)
What it reads: The footer, address elements, structured data, meta tags and links — plus the page body when the page itself is a legal notice or terms. Never fields, files, submissions or the clipboard
What is stored: Only the operator information read from the site (chrome.storage.session, cleared when the browser restarts). What you do is never stored
External traffic: None (connect-src 'none' in the CSP)
Analytics / telemetry: None
Main limits: Makes no safety judgement. Does not verify that the statements are correct. Finding nothing does not mean a site is safe

Last checked 1 September 2026, against the versions published on the Chrome Web Store on that day.

What changed in each tool is posted on News.

See the release history →

VERIFY

How to verify it yourself

Chrome itself lets you check both the traffic and the permissions.

Inspect permissions

Open chrome://extensions and click “Details” on an extension to see the permissions it requests.

Watch the traffic

Traffic from the extension itself (its service worker) does not show in the page’s DevTools. Use its own DevTools instead.

Open chrome://extensions and turn on “Developer mode” in the top right.
Click the “Service worker” link on the extension to open its dedicated DevTools (if it reads “Inactive”, clicking wakes it up).
Keep the Network tab of that dedicated DevTools open while you use the extension, and confirm that no external requests occur.
Traffic from content scripts running in the page shows in the page’s own DevTools (F12) → Network. For the popup or the options page, right-click inside it and choose “Inspect”.

Chrome’s official extension debugging guide

Traffic limited by the CSP

Attachment / Night / Site Operator Check declare connect-src 'none' in the CSP in manifest.json. Network connections from those extension pages are blocked by the browser.

LIMITS

Known limits

These are not security products

None of them is a DLP, an antivirus or a phishing detector. Nothing here decides whether something is dangerous, and nothing here can force a send or a page to stop. They are not a replacement for the measures you already have.

Detection is not complete

Misses and false positives both happen. Finding nothing does not mean there was nothing to find.

The scope differs by product

Supported sites, file types and browser requirements are not the same for every tool. See the table above and each product page.

An update can change this

Updating an extension can change the permissions it asks for or what it stores. The date this page was last checked is under the per-product list.

For details on each product, see its product page and privacy policy.

Who makes these is set out on a page of its own.

About Legacy Tools →