Inspection stays on your device.

Text inspection (secret and personal-data detection) and on-screen masking run entirely on your device, via a compiled WebAssembly engine bundled in the extension. Your messages still go to the services you use (AI, Gmail, Outlook web): Proxia inspects them before they leave and, if you choose, replaces them with a pseudonymized version. Proxia never sends inspected content (prompts, page text) off your device. Outside the browser, it only passes data to local programs enabled by you or your administrator: inspected text to the local ML detector, detected values to the vault (see below). The only other output: when you choose the protected version and Proxia cannot put it back into the field, it copies it to the system clipboard (which your system may sync across your devices).

Your settings (per-site activation and profiles, sensitive terms, masked sites, trusted domains and disabled categories, local ML detector address), your licence token (it contains the customer identifier given when it was issued), monthly counters without content (alerts per category and per site) and, in Gmail, the list of phishing warnings you dismissed (message identifier and fingerprint, date, without content) are saved locally via the browser storage API, on your machine. A value you choose to stop flagging is kept as an ephemeral HMAC fingerprint in session storage, never in plain text. If the vault is enabled and the Proxia native host installed (Chrome/Edge), by you or your administrator, detected values are passed to it locally for comparison, at each inspection; it keeps only fingerprints, in an encrypted file (AES-256-GCM) whose key stays in the OS credential store. Not synced to any publisher server.

The extension makes no network calls to the publisher or third parties: no analytics, no telemetry, no account; the licence is verified offline. Detection rules are bundled in the extension, whose updates are delivered by the browser (extension store or managed deployment). The only network request the extension makes is the call to the local ML detector, on your device, if you enable it.

The permissions (storage, active tab, scripting, native messaging, host access) are used solely for the features described in this policy and on the store listing, and for local processing. Native messaging only reaches the local Proxia host of the optional vault. Access to a site outside the built-in list (listed AI sites, Gmail, Outlook web, Teams, Jira/Confluence) is requested site-by-site, on explicit user action: adding a site to mask, or saving the local ML detector address.

Under managed deployment, an administrator can configure the extension via the browser policy (inbound settings only); this results in no data being sent. The Proxia policy cannot, for now, prohibit the local ML detector: a Plus user can enable it themselves.

Proxia reads this text in the page, on your device. Listed AI sites (ChatGPT, Claude, Gemini, Copilot…): prompts, pastes, attached files and replies. Gmail: drafts when sent, attachments as soon as they are added, text pasted into an input field, and displayed sender and recipient addresses; the open email is also analysed for the phishing warning. Outlook web: drafts, when saved and when sent, and displayed text, including received messages and sender and recipient addresses; on outlook.cloud.microsoft and outlook.live.com, also pastes and attached files. Teams: displayed text. Jira and Confluence: displayed text; in Confluence, also pastes, attached files, saved pages and drafts, and other content sent by the Confluence editor (comments…). Sites you add: displayed text. Except on Gmail, displayed text includes the value of input fields, passwords excluded. On the listed AI sites, Outlook web (outlook.cloud.microsoft, outlook.live.com) and Confluence, Proxia also reads the page's network traffic: the written text carried by an outgoing request (message, search, comment, saved draft…) and all the text of the responses the site's API returns at send, conversation, message, search, Confluence page or similar addresses, including history, content and metadata loaded by the site, even if not displayed. On-screen masking is on by default on Gmail (sender and recipient identities), Outlook web, Teams and Jira/Confluence; you can turn Proxia off site by site from the popup, unless your administrator enforces it.

Reserved for Proxia Plus, this optional connector sends the full text of each inspection to a detector that you install and run on the same device, including the page and network content described above. It accepts only localhost, 127.0.0.1 or [::1]; Chrome and Edge request permission to access the local service. The connection check also sends a fixed test text. ANANKELIS does not receive these texts. You or your administrator are responsible for that local program and any logging, storage or onward transmission it performs. Empty the detector address to stop these requests: revoking a browser permission alone may not be enough for a local service that accepts requests from other origins. On Safari, keep the connector disabled unless the guide for your installed version confirms compatibility and protection against redirects. A local service redirect can otherwise expose text to another host. Built-in local inspection does not require this connector.