Privacy Policy - PromptShield

Last Updated: March 9, 2026

Overview

PromptShield is a Chrome extension that scans code on GitHub for AI prompt injection vulnerabilities. We are committed to protecting your privacy and being transparent about our data practices.

Data Collection

Information We Collect

Code Content: When you scan a file, the code content is temporarily sent to our backend API for analysis.
File Metadata: Filename, programming language, and file size.
Scan Results: Vulnerability reports and security scores are stored locally in your browser.
Extension Usage: We do NOT collect analytics, tracking data, or usage statistics.

What We DON'T Collect

        ❌ Personal identifying information (name, email, etc.)
❌ Browsing history
❌ GitHub credentials or authentication tokens
❌ Repository access beyond public code viewing
❌ Analytics or tracking data
❌ Cookies

      

Data Usage

How We Use Your Data

Security Analysis: Code is analyzed by our AI-powered backend to detect prompt injection vulnerabilities.
Local Storage: Scan history (last 50 scans) is stored in your browser's local storage for quick access.
Display Results: Vulnerability reports are shown in the extension popup.

Data Retention

In Transit: Code sent to our API is processed in real-time and NOT stored on our servers.
Local Browser: Scan history is kept in your browser's local storage (managed by you).
Backend Logs: Anonymized request logs (no code content) are kept for 7 days for debugging purposes only.

Data Sharing

We do NOT share, sell, or transfer your data to third parties, with the following exceptions:

Groq AI API: Code is sent to Groq's LLM API for analysis. See Groq's Privacy Policy.
Vercel Hosting: Our backend is hosted on Vercel. See Vercel's Privacy Policy.

Data Security

Security Measures

        ✅ HTTPS Encryption: All data transmitted is encrypted
            using TLS 1.3.
✅ CORS Protection: Only the official extension can
            communicate with our API.
✅ Rate Limiting: 10 requests per minute to prevent abuse.
          
✅ Input Validation: All inputs are sanitized to prevent
            injection attacks.
✅ No Data Persistence: Code is NOT stored on our servers
            after analysis.

      

Your Rights & Controls

User Controls

Clear Scan History: Click "Clear History" in the extension popup to delete local scan data.
Uninstall Extension: Removes all local data from your browser.
Opt-Out: Simply don't use the scan feature if you don't want to send code to our API.

Data Access & Deletion

Since we don't store your code or personal data on our servers, there's nothing to delete. Local browser data can be cleared through the extension popup or by uninstalling.

Permissions Explanation

Required Permissions

activeTab: Access the currently active GitHub tab to extract code.
storage: Store scan history locally in your browser.
scripting: Inject the scan button into GitHub pages.
notifications: Show scan completion notifications.
host_permissions (github.com): Only works on GitHub.com pages.

Open Source & Transparency

Source Code: GitHub Repository
Backend API: Fully auditable and open source
No Tracking: No analytics SDKs or tracking scripts

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page and the extension will be updated with a new version number.

Contact

For privacy concerns or questions:

GitHub Issues: Create an issue
Repository: View source code

Compliance

        ✅ GDPR Compliant: We don't collect personal data.
✅ CCPA Compliant: We don't sell personal information.
✅ Chrome Web Store Policy Compliant: Single-purpose
            extension with minimal permissions.

      

TL;DR (Summary)

PromptShield scans GitHub code for security vulnerabilities. Code is sent to our API for real-time analysis (not stored). Results are saved locally in your browser. We don't collect personal data, analytics, or tracking information. Your privacy is our priority.