Privacy Policy

Last Updated: July 16, 2026

Overview

RuleSentry (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how our software products (browser extension and desktop application) handle your data when you use our services.

Privacy-First Design

RuleSentry processes all data locally on your device. The Chrome Extension uses WebAssembly running entirely in your browser. The Desktop App processes on your device using a native Rust engine. We do not collect, transmit, or store your sensitive data on our servers.

What Data We Collect

1. Data We DO NOT Collect

RuleSentry does NOT collect, access, transmit, or store:

  • Your conversations with AI assistants (ChatGPT, Gemini)
  • Content you type or paste into chat interfaces
  • Files you upload to AI assistants
  • Documents you scan or redact in the Desktop App
  • Sensitive data detected by the software (PII, API keys, secrets)
  • Pseudonymization mappings or transformed content
  • Browsing history or activity outside supported AI chat sites

2. Local Storage

2a. Chrome Extension

The Extension stores the following data locally in your browser using Chrome's storage API:

  • Extension settings: Your preferences for enabling/disabling features per site
  • Pseudonymization mappings: Original values and their pseudonyms (stored locally only)
  • Scan history: Records of scans performed (stored locally only)

2b. Desktop App

The Desktop App stores the following data locally on your device:

  • SQLite database: Custom rules, policies, categories, and entities you create
  • App settings: Stored locally via tauri-plugin-store
  • NER model files: Stored locally if you choose to download them

AI Provider Keys (Optional)

The Desktop App optionally accepts API keys for AI-assisted entity generation and chat (Anthropic, OpenAI-compatible services, Google Gemini), and can use a locally installed Ollama with no key at all. If you configure a provider:

  • Keys are stored in your operating system's credential store (e.g. Windows Credential Manager) and never transmitted to RuleSentry
  • When used, rule and policy descriptions are sent directly to the provider you chose — do not include sensitive data in these descriptions
  • RuleSentry retains no data from these interactions

This data never leaves your device and is stored exclusively in local storage.

3. Anonymous Usage Statistics (Optional, Off by Default)

The Desktop App includes an optional telemetry feature to help us improve AI-assisted rule generation. It is disabled by default and only activates if you turn it on in Settings → Privacy:

  • Opt-in only: No telemetry is sent unless you explicitly enable the toggle; you can turn it off again at any time
  • What is sent when enabled: Anonymous AI Builder session quality metrics — token counts, entity types, validation error categories, and prompt lengths
  • What is never sent: Your prompt text, rules, policies, scanned documents, detected matches, API keys, or any other content — under any setting
  • When disabled (the default): Zero telemetry network calls are made

The Chrome Extension contains no telemetry or analytics of any kind.

How We Process Your Data

Chrome Extension

  • Local Processing: The Extension runs WebAssembly code entirely in your browser
  • No Network Transmission: Your data is never sent to our servers or any third-party services
  • Fully Offline: The Extension works completely offline after installation

Desktop App

  • On-Device Processing: All scanning, evaluation, and redaction happens locally on your device using a native Rust engine
  • Offline by Default: The core detection engine works fully offline. The Desktop App makes network calls only for: catalog sync (downloading rule/policy definition updates from our servers — no user data is uploaded), optional NER model downloads (only if you choose to install them), optional AI provider calls (only if you configure a provider), and opt-in telemetry (only if you enable it)
  • Optional AI Providers: If you configure a provider and use the AI builder or chat, rule/policy descriptions and your chat messages are sent to that provider. No scanned document content or detected matches are included in AI builder requests

Interception Architecture & Transparency (Extension)

The Extension intercepts content before it's sent to AI providers using multiple techniques:

  • DOM Monitoring: Watches for changes to text input fields and contenteditable elements
  • Event Interception: Captures click and keyboard events on send buttons
  • Network Request Hooking: Intercepts fetch/XMLHttpRequest API calls at multiple layers
  • Pre-Send Scanning: Analyzes content immediately before transmission

Technical Challenges

While we strive for comprehensive interception, the dynamic nature of modern web applications presents technical challenges:

  • Varying web implementations: Different AI providers use different frameworks and transmission methods
  • Telemetry and analytics: Platforms may send data through multiple channels, including separate endpoints
  • Provider updates: Frequent interface changes require continuous monitoring and adjustments
  • Asynchronous operations: Complex async patterns can create timing-dependent edge cases

We continuously test interception accuracy using Wireshark network analysis and monitor provider changes. When we discover gaps, we prioritize fixes and release updates promptly.

What Remains Guaranteed

Regardless of interception challenges, 100% local processing is absolute and unchangeable. All data that RuleSentry processes remains on your device. Your preview modal review serves as the final safeguard for privacy protection.

Third-Party Services

The Extension operates on third-party AI chat websites:

  • ChatGPT (chat.openai.com, chatgpt.com)
  • Gemini (gemini.google.com)

The Extension intercepts content before it reaches these services to scan for sensitive data. However, we do not control these third-party platforms. Please review their respective privacy policies:

The Desktop App can optionally use AI providers for AI-assisted entity generation and chat when you configure them. If you use one, that provider's privacy policy applies to the requests sent to it:

Data Security

We implement security best practices:

Chrome Extension

  • Content Security Policy (CSP): Strict CSP prevents unauthorized code execution
  • Minimal Permissions: The Extension requests only necessary permissions (activeTab, storage)
  • Host Restrictions: Only runs on specified AI chat websites
  • Local Storage: All user data is stored locally in browser storage, protected by browser security

Desktop App

  • Local SQLite Storage: All custom entities stored in a local database on your device
  • Tauri CSP: Content Security Policy enforced in the Tauri webview
  • Limited Network Calls: Network connections are limited to catalog definition sync, optional model downloads, optional user-configured AI providers, and opt-in telemetry — your scanned content is never transmitted

Your Rights and Control

You have complete control over your data:

Chrome Extension

  • Access: All your data is stored locally in browser storage (accessible via extension popup)
  • Export: Export pseudonymization mappings to CSV at any time
  • Delete: Clear all extension data via the extension popup or by uninstalling
  • Control: Enable/disable the extension per site or globally at any time

Desktop App

  • Uninstall: Uninstalling the Desktop App removes all local data
  • Manual Deletion: The SQLite database and settings files can be deleted manually from your filesystem

Since we don't collect your data on our servers, there is nothing for us to delete. Uninstalling the software removes all local data from your device.

Children's Privacy

RuleSentry is not intended for use by children under 13 years of age. We do not knowingly collect information from children. The software operates on AI chat platforms that have their own age restrictions.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. Material changes will be communicated via:

  • Software update notification (if applicable)
  • Notice on our website homepage

Continued use of the software after changes indicates acceptance of the updated policy.

GDPR and CCPA Compliance

RuleSentry's privacy-first architecture means:

  • No Data Controller Issues: We don't collect or control your personal data
  • No Data Transfers: Your data never leaves your device
  • No Right to Deletion Requests: Since we don't have your data, there's nothing to delete from our servers
  • Data Minimization: We only store essential settings locally

For California residents: Because we don't collect personal information, we don't sell or share it either.

Contact Us

If you have questions about this Privacy Policy or our practices, please contact us:

Summary: RuleSentry protects your privacy by design. The Chrome Extension processes all data locally in your browser. The Desktop App processes all data on your device. We don't collect, transmit, or store your sensitive data. Your data never leaves your device.