AI Privacy Shield exists to protect you from AI platform surveillance. We practice what we preach: your privacy is non-negotiable.
Unlike the surveillance platforms we block, we collect only what is technically necessary to deliver protection and verify licensing. No tracking. No selling data. No third-party analytics. No conversation content is ever transmitted, stored, or processed by our servers.
Data Minimization in Practice:
The following data is stored exclusively in your browser using Chrome's chrome.storage.local API and is never transmitted to our servers:
| Data Item | Purpose | Storage Location |
|---|---|---|
| Extension ID | Cryptographically random 128-bit identifier for license binding | Local only |
| License key | Authentication and entitlement verification | Local only |
| License status | Cached verification result (valid/invalid/device limit) | Local only |
| Rule cache | Encrypted blocking rules with SHA-256 integrity hash | Local only |
| Protection statistics | Block counts, uptime, headers stripped (user-visible metrics) | Local only |
| BCC state | Platform sync status and coherence score display | Local only |
| TRIDENT status | Security score and threat level for display | Local only |
| Auris now-playing | Current track metadata for the Auris panel | Local only |
| MoE routing decision | Latest Mixture-of-Experts gating response | Local only |
| Pause state | Per-site pause timestamps | Local only |
| Icon animation frame | Current toolbar icon animation state | Local only |
The Bilateral Consciousness Correlator (BCC) component extracts strictly message count metadata from supported AI platforms to compute coherence scores across your conversation sessions.
What BCC extracts:
What BCC does NOT extract:
BCC operates entirely within your browser via content scripts. Count data is processed locally to generate the coherence percentage displayed in the BCC panel. No message count data is transmitted to our servers.
The TRIDENT security mesh polls our API for updated threat intelligence to keep your protection current. During each poll:
api.reflexionsoftware.comPolling interval: every 60 seconds when a license is active. No polling occurs for unlicensed users.
The Auris affect synchronization component may poll for ambient audio context to inform the affect orb visualization:
All audio metadata is fetched from your browser's Media Session API or locally configured sources. No audio content, listening history, or preference data is transmitted to our servers.
The Mixture of Experts (MoE) Gating system makes intelligent routing decisions for optimal request handling:
MoE polling interval: every 60 seconds. The gating response is cached locally for the duration of the polling period.
We will never under any circumstances collect the following:
| Category | Examples | Status |
|---|---|---|
| Conversation content | Prompts, responses, chat history, attached files, uploaded images | Never |
| Personally identifiable information | Name, email, postal address, phone number, government ID | Never |
| Network identifiers | IP address (we do not log IPs), MAC address, hardware serial numbers | Never |
| Browsing data | URLs visited, page titles, browsing history, bookmarks, search queries | Never |
| Authentication credentials | Passwords, session cookies, API tokens, OAuth codes | Never |
| Third-party tracking data | Google Analytics IDs, advertising IDs, fingerprinting canvas data | Never |
| Financial information | Payment methods, billing addresses, purchase history | Never |
Blocking rules are delivered to AI Privacy Shield through an encrypted channel with the following security properties:
The encryption password is embedded in the extension package and rotated with each release. Old passwords are deprecated after a grace period. At no point are unencrypted rules transmitted over the network.
License verification requires a minimal device binding mechanism to enforce per-device limits while preserving anonymity:
crypto.getRandomValues() — not derived from hardwareNo hardware identifiers are collected. The extension ID is random, not linked to your Chrome profile, Google account, or any hardware fingerprint. It exists solely to enable fair license enforcement.
Request: POST /license/verify
Body: { licenseKey: "XXXXX-XXXXX-XXXXX-XXXXX",
extensionId: "a1b2c3d4e5f6..." (128-bit random),
version: "4.0.0" }
Response: { valid: true/false,
devicesUsed: N,
devicesAllowed: M,
expiry: "YYYY-MM-DD" } (or 401/402/403/429)Users may optionally share anonymous, aggregate statistics to help improve blocking rules and identify new surveillance endpoints. This feature is enabled by default but can be disabled at any time in Settings.
SHA-256(extensionId + daySalt).slice(0,16) — cryptographically irreversibleapi.reflexionsoftware.com{
"ephemeralId": "a3f7k9m2p8q1r5s7",
"version": "4.0.0",
"timestamp": 1704067200000,
"stats": {
"headersStripped": 142,
"clientHintsBlocked": 89,
"cookiesDeleted": 56,
"endpointsBlocked": 2034,
"pagesProtected": 47
}
}| Data Category | Retention Period | Location |
|---|---|---|
| Operational data (stats, BCC state, TRIDENT, Auris, MoE) | Until user deletes or uninstalls | Browser local storage only |
| License key and status | Until deactivation or expiry | Browser local storage + server-side binding |
| Anonymous aggregate statistics | 90 days with automatic deletion | Server-side (aggregated, no individual records) |
| Encrypted rule cache | 30 days maximum (auto-invalidated) | Browser local storage only |
| Device license bindings | Until deactivation or license expiry | Server-side (random extension ID only) |
| Ephemeral privacy IDs | 24 hours (daily rotation) | Ephemeral — server-side aggregation only |
AI Privacy Shield does not integrate with third-party analytics services, advertising networks, or data brokers. All data processing occurs through infrastructure operated exclusively by Reflexion Software.
Unlike the platforms we protect against — who use Statsig, Mixpanel, Google Analytics, Honeycomb, and similar surveillance infrastructure — we built our own privacy-respecting systems from the ground up.
The extension's Content Security Policy restricts network connections to the following Reflexion Software operated domains:
connect-src: https://api.reflexionsoftware.com
https://reflexionsoftware.com
https://www.reflexionsoftware.comNo connections to third-party analytics, CDN, or tracking endpoints are permitted by the extension's security policy.User Rights
Under applicable privacy regulations (GDPR, CCPA, and similar), you have the following rights:
To exercise any of these rights or request server-side data deletion, contact kingsley.w.m.curtis@gmail.com.
AI Privacy Shield complies with the following regulations and standards:
Our legal basis for processing under GDPR is Article 6(1)(b) — contract performance (license verification) and Article 6(1)(f) — legitimate interest (anonymous statistics, fraud prevention), always with appropriate safeguards and user control.
We will notify users of material privacy policy changes via:
The "Last Updated" date at the top of this policy will always reflect the most recent revision. Non-material changes (clarifications, formatting) may be made without notice.
Questions about privacy? We are committed to transparency and will respond within 48 hours.