ShieldVault Browser Extension
ShieldVault watches what you type or paste on certain websites and warns you when it spots something sensitive — like an API key or a heated message — before you send it. The text being checked never leaves your device.
Settings and a log of detection events (just the website and the time, never the actual text) are saved on your computer so the extension remembers them between sessions.
The only time ShieldVault talks to the internet is when you activate a paid Pro subscription — and even then, only your license key is sent for verification. That's it.
If that's all you needed to know, you're done. Everything below is the long version with technical details.
ShieldVault is built on a "detection without possession" principle. The extension analyzes text you type or paste in real time to detect sensitive content — API keys, credentials, confidential markers, and emotionally charged language — and warns you before that content is sent. The text being analyzed never leaves your device.
ShieldVault inspects text you type or paste into input fields on these websites:
The analysis runs entirely on your device using pattern matching. The text being analyzed is never transmitted, stored, or shared. After analysis completes, the text is discarded from extension memory.
ShieldVault uses Chrome's local extension storage (chrome.storage.local) to remember the following information across browser sessions. This information stays on your device and is never sent to any server:
All of this data can be cleared at any time by uninstalling the extension or by clicking "Clear" inside the extension's activity panel.
ShieldVault makes network requests in only one circumstance: license verification.
When you activate a Pro subscription using a license key, the extension sends the license key string to ShieldVault's verification endpoint (https://shieldvault.site/api/license/verify or its backup https://extension-paywall.replit.app/api/license/verify). The server confirms whether the key is valid and returns a yes-or-no response. The same verification call may run when the extension loads, to confirm that an existing Pro activation is still valid.
These license verification requests transmit only the license key. No browsing data, no detected text, no detection events, no usage statistics, and no personally identifying information are transmitted with the request.
If you do not activate Pro, ShieldVault makes no network requests at any time.
If you choose to upgrade to Pro, you are redirected from the extension to a checkout page hosted by ShieldVault (https://shieldvault.site/api/checkout/quick), which uses Stripe to process payment. The extension itself never sees, handles, or stores your payment card information. Stripe collects payment information directly under their own privacy policy. After successful payment, you receive a license key, which you then enter into the extension to activate Pro.
ShieldVault requests the minimum permissions necessary:
storage permission: Used to save your settings, lifetime statistics, activity log metadata, and (if applicable) Pro license status to local extension storage on your device.host_permissions for https://shieldvault.site/* and https://*.replit.app/*: Used solely to verify Pro license keys when you activate a subscription.ShieldVault is not directed at children under 13 and does not knowingly collect personal information from children under 13.
If this policy changes, the updated version will be posted at this URL. Material changes — anything that affects what data is handled or how — will be reflected in the version date below.
Questions about this privacy policy? Email privacy@shieldvault.site