Privacy Policy

PureCipher Prompt Firewall helps protect users from prompt injection and unsafe browser-to-AI handoffs. It scans webpage content locally, identifies risky handoff patterns, sanitizes suspicious content in protected workflows, and provides safe review flows.

Core page and prompt processing happens locally in the browser. The current release does not include advertising, remote analytics, or default-on telemetry.

To provide its security features, the extension may process webpage content, selected or page-derived text, clipboard-related text in protected workflows, the current page hostname, and user-selected settings.

It may also create minimal intervention metadata such as event type, affected surface, severity, count-style information, hostname, optional user feedback, and local review-scoring metadata. This supports transparency in the extension popup and optional local exports.

• Sync storage: protection settings and optional-feature preferences.
• Session storage: recent intervention history and short-lived, one-time Safe Handoff or Safe Summary payloads when supported by the browser.
• Local storage: optional structured learning signals, a local salt for hashed host indicators, and compatibility fallbacks. Optional learning signals are retained for up to 30 days unless cleared sooner.
• Memory: temporary runtime information needed for review and protection logic.

Version 0.2.0 does not upload raw page text, raw prompt text, clipboard contents, full browsing URLs, or page titles to PureCipher by default. It does not sell user data, share data with data brokers, or automatically transmit structured learning signals.

The release does not fetch or execute remote code. Optional signed-update and coordinator controls are disabled by default and require explicit configuration and user action.

If enabled, the extension can create privacy-preserving reports or structured learning batches locally. These exports are designed to omit raw page text, prompts, URLs, titles, and intervention messages, and to use hashed or per-report host indicators instead of raw hostnames.

Exports are copied locally for the user and do not leave the device unless the user chooses to share them.

The extension requests clipboard write access for user-facing actions such as copying sanitized selections and optional local reports. When clipboard protection is enabled, it may process copied or pasted text locally to remove suspicious prompt-injection lines before an AI handoff.

If a user chooses to send content to an AI provider such as ChatGPT, Claude, Gemini, Copilot, Perplexity, Poe, Grok, or another service, the resulting interaction is governed by that provider's terms and privacy practices. PureCipher can detect, pause, sanitize, or help review a handoff, but it does not control the provider.

PureCipher's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

PureCipher minimizes persistent storage of sensitive content and prefers local processing. Users can disable protection features, keep optional learning signals off, clear local learning data, and avoid sharing optional exports. No software can guarantee perfect security.

Prompt Firewall is a general browser security tool and is not designed specifically for children. If a future release introduces hosted services or cross-border data transfers, this policy will be updated before those changes are released.

Material changes to extension data handling will be reflected in an updated policy before release.

For privacy or support questions, email support@purecipher.com. For security reports, email vamsi@purecipher.com. You can also visit Prompt Firewall Support.