PhishGuard AI — Privacy Policy

Version 1.0 · Applies to PhishGuard AI extension v3.1.0 and later · Effective: August 23, 2026

Short version: PhishGuard AI does not collect, transmit, sell, or share any personal data. All URL and message analysis runs locally inside your browser. There are no accounts, no analytics, no trackers, and no servers operated by us.

1. What the extension processes (and where)

PhishGuard AI analyzes URLs you visit or scan, and message text you paste into the Message Scanner. This processing happens entirely on your device using an AI model bundled inside the extension.

URLs and page addresses are converted to numeric features and evaluated locally. They are never sent anywhere.
Pasted message text (email/SMS content) is analyzed locally in the popup and is never transmitted.
Scan results (verdict, score, timestamp) are cached in your browser's local extension storage to avoid re-computation.

2. What is stored on your device

All data lives exclusively in your browser's local extension storage (chrome.storage.local) and is never synced or uploaded:

Your trusted / blocked domain lists
A small cache of recent scan results
Aggregated verdict counters for the statistics dashboard (counts only — no URLs or message text)
Your preferences (e.g. auto-protect level, optional server mode toggle)

Removing the extension deletes all of it. Nothing persists outside your browser.

3. Network behavior

The extension makes no network requests for analysis purposes.

Optional exception: if you explicitly enable "Server Mode" in settings, scan requests are sent only to a backend server you configure. The default address points to your own machine (localhost:5000). Server Mode is off by default, and when it is off (or unreachable), the extension silently uses its built-in offline engine.

4. Permissions and why they are needed

activeTab, scripting, host access (<all_urls>) — to analyze the URL of the page you are on and show warning banners when a site is flagged.
storage — to save your trust lists, preferences, stats, and result cache locally.
contextMenus — for the right-click "Scan this link" option.
notifications — to show the verdict of right-click scans without opening the popup.

5. No data sale, no tracking

We do not sell, rent, or share any data. We do not use third-party analytics, advertising SDKs, fingerprinting, or remote fonts/scripts. The extension contains no code that phones home.

6. Children's privacy

PhishGuard AI is a general-audience tool and collects no data from anyone, including children under 13.

7. Changes to this policy

If a future version ever introduces data collection, this policy will be updated and the store listing will disclose it before that version ships. The "collects nothing" declaration is enforced in the extension manifest itself (data_collection_permissions: none).

8. Contact

Questions or privacy requests: open an issue on the project repository or contact the developer via the support email listed on the store listing.