Security

Privacy Shield Security

Understand exactly how Privacy Shield handles your information — reflecting a full security audit of the extension's manifest permissions, content scripts, service worker, storage, and CSP.

In one sentence: Privacy Shield detects sensitive information using deterministic, local pattern matching, and never sends pasted content, detected values, or browsing activity over the network. The only network calls it makes are license-key activation/validation against Dodo Payments — which never see pasted content either.

Four isolated contexts

Each part of the extension has a narrow, explicit job — hover the boundaries below: what each one can see, and what it's structurally unable to do.

Content script

Runs on every http(s) page

The page's DOM
Clipboard data — only during a real paste event

No network requests
No cross-tab access
No clipboard access outside a paste

Service worker

Extension background

The protection on/off flag
Runs the weekly license re-check

Never touches pasted text
Never touches page content or clipboard

Popup

Toolbar

Local settings/stats
Can activate/validate a license key

Never sees pasted content
Only ever sees aggregate counters

Options page

Settings tab

Local settings
Can activate/validate a license key

Never sees pasted content

What happens to a paste

One straight line, always in this order — nothing skips a step.

Paste event fires

Trusted event? Protection on?

Local detection engine (15+ detectors, in memory)

Your decision: Sanitize / Anyway / Cancel

The content script reads pasted text directly off the paste event — never via a clipboard API, never on a timer. Detection never touches storage or the network.

Permissions

Two requested. Everything else, deliberately absent.

storage

The extension's entire persistence layer — settings, aggregate stats, license state, all local.

alarms

Schedules a weekly re-check of your license so a refunded/deactivated key stops working — grants nothing beyond that timer.

host_permissions

test.dodopayments.com + live.dodopayments.com only — solely to activate/validate a license key. No API key is ever bundled in the extension; Dodo's license endpoints are deliberately public/no-auth.

Never requested

clipboardRead tabs activeTab scripting notifications downloads

Storage, third parties & telemetry

The rest of what an audit checks, in five facts.

Storage

Everything lives in chrome.storage.local: settings, stats, license state. No matched paste value is ever stored — only running counts like "12 API keys blocked today."

Third-party services

One: Dodo Payments. It processes purchases and license activation — never receives anything you paste, only the license key itself.

Telemetry

None. No analytics SDK, no crash reporter, no third-party runtime code of any kind ships inside Privacy Shield.

Updates

Delivered through the Chrome Web Store's standard auto-update mechanism — the same path every Chrome extension uses.

Content Security Policy

script-src 'self'; object-src 'self'; base-uri 'none' — an injected inline script cannot run, even inside the extension's own pages.

Responsible disclosure

Found a security issue? We want to hear about it.

Email support@privacyshield.in