// processing100% local processing
Text inspection (secret and personal-data detection) and on-screen masking run entirely on your
device, via a compiled WebAssembly engine bundled in the extension. Your messages still go to the
services you use (AI, Gmail, Outlook web): Proxia inspects them before they leave and, if you
choose, replaces them with a pseudonymized version. Proxia never sends inspected content (prompts,
page text) off your device. Outside the browser, it only passes data to local programs enabled by
you or your administrator: inspected text to the local ML detector, detected values to the vault
(see below). The only other output: when you choose the protected version and Proxia cannot put it
back into the field, it copies it to the system clipboard (which your system may sync across your
devices).
// storageLocal storage only
Your settings (per-site activation and profiles, sensitive terms, masked sites, trusted domains
and disabled categories, local ML detector address), your licence token (it contains the customer
identifier given when it was issued), monthly counters without content (alerts per category and
per site) and, in Gmail, the list of phishing warnings you dismissed (message identifier and
fingerprint, date, without content) are saved locally via the browser storage API, on your
machine. A value you choose to stop flagging is kept as an ephemeral HMAC fingerprint in session
storage, never in plain text. If the vault is enabled and the Proxia native host installed
(Chrome/Edge), by you or your administrator, detected values are passed to it locally for
comparison, at each inspection; it keeps only fingerprints, in an encrypted file (AES-256-GCM)
whose key stays in the OS credential store. Not synced to any publisher server.
// networkNothing sent to the publisher or third parties
The extension makes no network calls to the publisher or third parties: no analytics, no telemetry,
no account; the licence is verified offline. Detection rules are bundled in the extension, whose
updates are delivered by the browser (extension store or managed deployment). The only network
request the extension makes is the call to the local ML detector, on your device, if you enable it.
// permissionsPermissions
The permissions (storage, active tab, scripting, native messaging, host access) are used solely
for the features described in this policy and on the store listing, and for local processing.
Native messaging only reaches the local Proxia host of the optional vault. Access to a site
outside the built-in list (listed AI sites, Gmail, Outlook web, Teams, Jira/Confluence) is
requested site-by-site, on explicit user action: adding a site to mask, or saving the local ML
detector address.
// enterpriseEnterprise
Under managed deployment, an administrator can configure the extension via the browser policy
(inbound settings only); this results in no data being
sent. The Proxia policy cannot, for now, prohibit the local ML detector: a Plus user can enable it
themselves.
// summaryNo collection by the publisher
The publisher collects no data through the extension: nothing is stored on servers, transmitted
to the publisher or third parties, or sold. Proxia only uses your content for the features
described here (inspection, masking, pseudonymization), on your device.
// text readWhat Proxia reads, site by site
Proxia reads this text in the page, on your device. Listed AI sites (ChatGPT, Claude, Gemini,
Copilot…): prompts, pastes, attached files and replies. Gmail: drafts when sent, attachments as
soon as they are added, text pasted into an input field, and displayed sender and recipient
addresses; the open email is also analysed for the phishing warning. Outlook web: drafts, when
saved and when sent, and displayed text, including received messages and sender and recipient
addresses; on outlook.cloud.microsoft and outlook.live.com, also pastes and attached files. Teams:
displayed text. Jira and Confluence: displayed text; in Confluence, also pastes, attached files,
saved pages and drafts, and other content sent by the Confluence editor (comments…). Sites you
add: displayed text. Except on Gmail, displayed text includes the value of input fields, passwords
excluded. On the listed AI sites, Outlook web (outlook.cloud.microsoft, outlook.live.com) and
Confluence, Proxia also reads the page's network traffic: the written text carried by an outgoing
request (message, search, comment, saved draft…) and all the text of the responses the site's API
returns at send, conversation, message, search, Confluence page or similar addresses, including
history, content and metadata loaded by the site, even if not displayed. On-screen masking is on
by default on Gmail (sender and recipient identities), Outlook web, Teams and Jira/Confluence; you
can turn Proxia off site by site from the popup, unless your administrator enforces it.
// local ML detectorLocal ML detector: advanced option, off by default
Reserved for Proxia Plus, this option connects Proxia to a detector that you install and run
yourself on your machine. It only works if you enter a local address (localhost, 127.0.0.1 or
[::1]) in the popup; in Chrome and Edge, the browser then asks for your permission to access it.
Any remote address is refused. Once the option is active, Proxia sends that program, on the same
device, the full text of each inspection (prompts, pastes, attached files, email drafts, saved
Confluence pages and drafts and other content sent by the Confluence editor, AI replies, text read
in the network traffic described above, even if not displayed, text displayed on Outlook web,
Teams, Jira/Confluence and sites you add, including input fields and emails, messages and
addresses received from third parties; on Gmail, displayed sender and recipient addresses), plus a
fixed test text when the popup checks the connection. The publisher never receives this text. What
that program does with it (logs, storage, forwarding to other services) is your responsibility or
your administrator's. Emptying the field stops the sending; removing the permission in the browser
is not always enough, as a local service that accepts requests from other origins remains
reachable. On Safari, the current package (prototype) does not yet have all these protections: it
follows redirects from the local service, so the text could then go to another host. Do not enable
this option there.