RD
RitualDevSTUDIO
AGENT DEFENSE & OFFLINE APPS
BACK TO PRIVACY CENTER
CHROME EXTENSION PRIVACY POLICY · LAST UPDATED: NOVEMBER 7, 2026

Privacy Policy for PromptShield Enterprise

Extension: PromptShield Enterprise·Publisher ID: 14103720-7a50-4083-a104-3bc47559c09e·Version: 0.1.0·Developer: RitualDev Studio

Executive Privacy Commitment: 100% In-Browser & Zero-Knowledge

PromptShield is engineered under an absolute zero-knowledge security mandate. All real-time Data Loss Prevention (DLP) regex pattern scans, Shannon entropy measurements, and surrogate token replacements occur 100% client-side inside your browser CPU using compiled WebAssembly. Your prompts, code snippets, database credentials, and proprietary conversations are NEVER transmitted to RitualDev servers, stored in remote databases, or shared with third parties.

1. Information We Process & What We Do NOT Collect

PromptShield operates on your device to inspect text inputs within generative AI web interfaces. Here is how your data is treated:

WHAT EXECUTES LOCALLY
  • Real-time keystroke and paste event scanning across supported AI chat web inputs.
  • Compiled WebAssembly regex matching against 60+ credential signatures (AWS, GCP, OpenAI, Stripe, etc.).
  • Shannon entropy analysis (H > 4.5) to catch high-entropy passwords and tokens.
  • Surrogate token injection (replacing sensitive secrets with synthetic mock surrogates).
  • AES-256-GCM encrypted local incident records stored in your browser's private storage.
WHAT WE NEVER COLLECT OR TRANSMIT
  • We NEVER record or transmit your full prompt text or conversation history.
  • We NEVER transmit unredacted API keys, passwords, or PII.
  • We NEVER operate an LLM proxy server or intermediate man-in-the-middle gateway.
  • We NEVER inject tracking cookies, Google Analytics, or third-party marketing SDKs.
  • We NEVER harvest browsing history, search queries, or active browser tabs outside configured AI hosts.

2. Chrome Extension Permissions Justification

PromptShield declares strictly the minimal required permissions under Google Chrome's Manifest V3 specification. Each permission is scoped exclusively to its single intended security purpose:

storageCore Manifest Permission

Used strictly to persist user security preferences (e.g. selecting between Surrogate Masking Mode, Strict Block Mode, or Silent Audit Mode), custom entropy thresholds, and locally encrypted incident records on your device via chrome.storage.local. No data in storage is ever synchronized to external servers in Community Edition.

activeTabInteractive Action

Activated solely when the user clicks the PromptShield toolbar action icon. It verifies whether the currently active browser tab is a supported AI chat web interface and displays real-time interception statistics (e.g., active shield status, session threats blocked) for that tab.

host_permissionsStrict Domain Allowlist

PromptShield deliberately avoids broad wildcard permissions (such as <all_urls>). Host permissions are strictly restricted to the specific generative AI interfaces where developers interact with LLMs:

https://chatgpt.com/*https://chat.openai.com/*https://claude.ai/*https://gemini.google.com/*https://chat.deepseek.com/*https://perplexity.ai/*https://copilot.microsoft.com/*https://chat.mistral.ai/*https://huggingface.co/*

This enables our content script (dist/content.js) to mount the local Shadow DOM prompt firewall over input textareas, intercept Enter keystrokes and paste events, and display real-time warning HUDs.

3. Zero Remote Code Execution Policy

PromptShield is 100% self-contained. All JavaScript execution logic, regex engines, UI components, and icons are packaged directly within the signed extension distribution (dist/background.js and dist/content.js). The extension:

  • Does NOT load external scripts via remote <script> tags.
  • Does NOT fetch or execute remote WebAssembly modules dynamically.
  • Does NOT use eval() or new Function() to interpret string code.
  • Adheres fully to Google Chrome's Manifest V3 security restrictions and Content Security Policy (CSP).

4. Limited Use & Regulatory Certifications

In compliance with Google Chrome Web Store Developer Program Policies, RitualDev certifies:

No Data Selling: We do not sell, rent, monetize, or transfer user information to data brokers, ad networks, or commercial third parties.
Single Purpose Adherence: All processed data is utilized solely to facilitate client-side prompt data loss prevention and credential firewall functionality.
No Creditworthiness Assessment: We do not use or transfer user data to evaluate creditworthiness, eligibility, or lending decisions.
Compliance Evidence: Incident audit logs can be exported directly by the user in cryptographically signed JSON or CSV formats for SOC 2 Type II (CC6.1/CC6.6), GDPR (Articles 32/33), and HIPAA (§ 164.312) regulatory verification.

5. User Control, Data Retention & Deletion

You maintain absolute control over all data stored by PromptShield:

  • Instant Purge: Click “Clear Audit History” inside the extension Settings panel to permanently erase all locally stored encrypted violation records.
  • Zero Cloud Persistence: Because Community Edition stores zero data in the cloud, uninstalling PromptShield from Chrome immediately and irreversibly deletes all extension state and local storage from your hard drive.

6. Contact, Publisher & Security Disclosures

If you have questions regarding this Privacy Policy, wish to report a security vulnerability, or require enterprise compliance documentation:

Security Team: security@ritualdev.in
Developer Support: developer@ritualdev.in