Privacy Policy
Effective 4 November 2026
The short version:
- On the free Personal plan, everything happens on your device. Nothing you type is sent to us or anyone else.
- We never store the text of your prompts. Local history keeps only what type of data was caught and when.
- We don't sell data, show ads, or use analytics or tracking.
- Business mode only starts if you enter an access token from your employer, and then sends only what's described below.
Who we are
Preflight.ai ("Preflight", "we") is a Chrome extension built by Vansh Saxena that warns you before sensitive information is sent to AI chat tools. This policy explains what the extension accesses, what it stores, and what (if anything) leaves your device.
What the extension reads
Preflight runs only on chatgpt.com, chat.openai.com and claude.ai. On those sites, when you press send, it reads:
- the text of the message you are about to send, and
- the contents of PDF, Word (.docx) and text files you attach, so they can be checked the same way.
It does not read your past conversations, other tabs, other websites, your browsing history, or anything else on your computer.
Personal mode (default)
All checks run inside your browser. In Personal mode the extension makes no network requests of its own, so nothing is sent to us or any third party.
Stored on your device
Using Chrome's local extension storage, Preflight keeps:
- Scan history (up to the last 500 checks): time, which AI site, the type of data detected (for example "PAN Number"), its risk level, what you chose (replace, send anyway, cancel) and the length of the message. It never includes the message text or the values that were detected.
- Your private keywords, if you add any in the popup.
You can export or clear the history from the popup at any time. Uninstalling the extension deletes all of it.
Business mode (optional)
Business mode is only used if your organization gives you an access token and you enter it in the popup. Your organization's Preflight server then receives data from your browser. Your employer decides how that data is used, under its own policies.
| What is sent | When |
|---|---|
| Scan metadata: time, detection types, risk level, the action you chose, how long the check took, extension version, browser type, AI site and whether text was typed, pasted or uploaded | After each check |
| The text of your message, for an AI check of things patterns can't catch (contracts, financial reports, strategy documents) | Only if your organization's plan includes AI checks, and only for messages that passed the on-device check |
| Your access token | With each request, to identify your organization |
The Preflight server is built so that message text sent for AI checks is classified in memory and is not logged or stored. Scan metadata never includes message text, previews, page titles or the detected values. Admins see counts and types of detections, not what anyone typed.
You can disconnect business mode at any time from the popup. This removes the token and any unsent metadata from your device.
Permissions we ask for
- Access to chatgpt.com, chat.openai.com and claude.ai: to check messages before they are sent.
- Storage: to keep your settings, keywords and local history on your device.
- Alarms: in business mode, to retry sending metadata that couldn't be delivered while offline.
What we never do
- Sell, rent or share your data with advertisers or data brokers.
- Use analytics, tracking pixels or fingerprinting.
- Use your data to train AI models.
- Load code from the internet. Everything the extension runs ships inside it.
Preflight's handling of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Children
Preflight is not directed at children under 13, and we do not knowingly collect information from them.
Changes
If this policy changes, we'll update the date above and describe material changes in the extension's release notes before they take effect.
Contact
Questions or requests about your data: email us.