I built a Chrome extension that anonymizes sensitive data before it reaches ChatGPT, looking for feedback
Over the past few months, I've been working with companies that are adopting AI tools like ChatGPT and Claude. One concern kept coming up: people inevitably end up pasting customer information, contracts, or internal documents into these tools because they're…
Over the past few months, I've been working with companies that are adopting AI tools like ChatGPT and Claude. One concern kept coming up: people inevitably end up pasting customer information, contracts, or internal documents into these tools because they're genuinely useful for getting work done. Instead of trying to block AI altogether, I wondered if there was a better approach. So I built a Chrome extension that detects sensitive information in a prompt, replaces it with placeholders, and only sends the anonymized version to the AI tool. The original data never leaves the browser. It currently works with ChatGPT, Claude, Gemini, Copilot, Perplexity, Grok, and several other AI platforms. I'd love honest feedback from people who use AI regularly. Does this solve a problem you actually care about?
已收录讨论
Moderator Announcement Read More » Hey u/Revolution-Expensive, If your post is a screenshot of a ChatGPT conversation, please reply to this message with the conversation link or prompt. If your post is a DALL-E 3 image post, please reply with the prompt used to make this image. Consider joining our public discord server! We have free bots with GPT-4 (with vision), image generators, and more! 🤖 Note: For any ChatGPT-related concerns, email support@openai.com - this subreddit is not part of OpenAI and is not a support channel. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
For now yes, Chrome only. Firefox is on the roadmap but not there yet
The extension sends the text to our API for anonymization, detection runs on our own infrastructure using multiple layers of analysis. Only the anonymized version with placeholders like [NAME] or [EMAIL] is sent to ChatGPT. Original prompts are not stored by default, though companies can optionally enable logging for compliance purposes.
hmmm so you're getting the sensitive data instead of chatgpt? why should people trust you over openai?
Thanks for taking the time to write this, these are exactly the right questions. On false negatives: agreed, this is the biggest risk. It's why detection isn't regex-only — we run multiple layers (pattern matching for structured stuff like account numbers, plus NER models for unstructured mentions that don't follow a clean pattern). No layer catches everything alone; the union catches a lot more. Still an arms race though, and I won't pretend it's 100%. On false positives mangling prompts: the placeholders preserve semantic type [NAME], [EMAIL], [ACCOUNT] so the model can still reason about the structure of the request even without the real values. In practice the answers come back usable, and the user sees what got replaced before anything is sent, so a bad redaction is visible rather than silent. Multi-turn is a genuinely hard one and you're right to flag it. Being honest: today placeholders are type-based [NAME], [EMAIL] not indexed per entity, so the model keeps the structure of the request but doesn't get a stable identity for "that customer from earlier" across turns. Entity-consistent replacements within a session ([NAME_1], [NAME_2]) are on the roadmap, and it's one of the harder parts of doing this at the prompt layer. The on-prem document classification approach makes a lot of sense for the layer you're working at keeping sensitive docs out of the flow entirely is the cleaner guarantee when you control the environment. We're betting on the messier reality where employees are already in the browser pasting things. Probably both layers end up mattering.
Nice, that's the other side of the trade-off we considered. Out of curiosity, what are you using for on-device detection? We went server-side because we couldn't find a local NER model that gave us acceptable recall on messy, real-world text (names, addresses, client data buried in long prompts) without becoming too heavy for the browser. If you've found something that works well locally, I'd genuinely love to know what you're using.
To be honest, I don’t know, I let Fable do the entire thing. I just know that I can modify the anonimyzed piece of information, should the extension get it wrong.
Just for chrome? I love the concept . I don’t use a chrome based browser.
That is something I would be extremely interested. Would you be willing to share what you built?
How is the data protected from the extension? What data is collected by the extension? ELI10
I built the same thing, but it works locally and offline. It accepts text, pdf, Excel, and images. It doesn’t upload the output directly to AI. It’s really great.
This is a genuinely useful idea and the timing makes sense, a lot of orgs are stuck between "ban AI entirely" and "hope employees don't paste in customer contracts," and neither works well long term. Detecting and swapping sensitive fields before the prompt leaves the browser is a smart middle ground, especially for smaller teams that don't have budget for a full DLP setup. A few things I'd think about as you build this out: false negatives are probably your biggest risk (things like account numbers embedded in unstructured text, or sensitive info that doesn't match a clean pattern like PII regex would), and false positives that mangle a prompt so badly the output is useless will kill adoption fast. Also worth considering whether placeholders survive multi-turn conversations if the user references "that customer from earlier" a few messages later. Full disclosure: I work at FabSoft, which makes AI File Pro, and we've run into a related version of this problem on the document side rather than the prompt side. Our approach has been to keep sensitive documents out of the flow entirely by processing and classifying them on-prem with Active Directory permissions gating access, so the sensitive content never has to travel anywhere near a browser or an LLM prompt in the first place. Different layer of the same problem, but it's an interesting contrast to what you're building. Good luck with it, this is a real gap worth solving.