Vakaso Secure Paste — Privacy Policy

1. Purpose, Operation & Scope

Vakaso Secure Paste is an automated developer safeguard designed to prevent accidental paste disclosure of API keys, authentication tokens, private keys, and database credentials into supported AI chat tools (including ChatGPT, Claude, Gemini, DeepSeek, and others). The extension matches known secret patterns client-side and presents a warning modal with an option to redact sensitive tokens before they enter the host application's text editor. Pattern-based matching serves as an automated layer of defense-in-depth, not an absolute guarantee that every possible credential or proprietary token will be caught. Users remain responsible for reviewing sensitive content before submission.

2. Local RAM Processing & Network Activity

When you paste text on a supported website:

• Clipboard text is inspected transiently in memory using linear $O(N)$ regex scanning and Shannon entropy calculations.
• Zero network calls during scanning: No network requests (HTTP, WebSocket, or analytics beacons) are ever made during scanning, clipboard processing, or secret redaction. Detection operates 100% offline.
• Detected secrets and clipboard contents are completely wiped from volatile memory once the paste or redaction action completes or is dismissed.
• The extension contains zero tracking cookies, zero analytics libraries, and zero advertising trackers.
• Pro License Verification: If you voluntarily purchase and activate a Pro lifetime license, the extension communicates strictly with our Merchant-of-Record payment provider, Dodo Payments (https://live.dodopayments.com/licenses/validate), solely to verify license validity. Only the entered license key string is transmitted; no clipboard contents, detected secrets, browsing history, or personal identifiers are ever sent.

3. Local Storage & Background Alarms

The extension requests the Chrome storage and alarms permissions for strictly defined purposes:

• Master Toggle: Whether paste protection is active or temporarily paused.
• Provider Categories: Which secret categories you have toggled on or off (AWS, OpenAI, Anthropic, GitHub, Stripe, Slack, Private Keys, Database Credentials, Bearer tokens).
• Local Catch Counter & Quota: A numeric integer tracking available auto-redactions (5 refilled every 12 hours) and referral status, stored strictly in device local storage.
• Background Alarms (chrome.alarms): Used solely for active Pro license holders to schedule a low-frequency 24-hour check to re-verify license validity against Dodo Payments. For free-tier users, no background alarm is ever scheduled or executed.

These settings remain strictly on your local machine and are never synced to our servers.

4. Scoped Website Matches

The extension operates strictly on the specific URLs where developers interact with AI chatbots and developer tools: ChatGPT (chatgpt.com, chat.openai.com), Claude (claude.ai), DeepSeek (chat.deepseek.com), Google Gemini (gemini.google.com), Google AI Studio (aistudio.google.com), Microsoft Copilot (copilot.microsoft.com, copilot.com), Perplexity (perplexity.ai), xAI Grok (grok.com), Mistral (chat.mistral.ai), Poe (poe.com), Hugging Face (huggingface.co, hf.space), v0 (v0.dev, v0.app), and Bolt.new (bolt.new). It does not request broad permissions such as <all_urls>, does not access your browsing history, and does not inspect tabs on any other website.

5. Chrome Web Store Limited Use Compliance

Vakaso Secure Paste adheres strictly to the Google Chrome Web Store User Data Policy, including the Limited Use requirements:

• We do not sell, rent, or monetize user data.
• We do not use or transfer user data for personalized advertising, credit assessment, or training AI/ML models.
• We do not allow humans to read user clipboard data.

6. Changes and Contact

If we update this Privacy Policy, the revised version will be published at this URL with an updated Effective Date.

If you have questions, feedback, or security inquiries regarding Vakaso Secure Paste, please contact us at: [email protected] or [email protected].