Vakaso Secure Paste — Privacy Policy

Effective Date: September 10, 2026 | Contact: [email protected]

🛡️ Zero-Telemetry Guarantee:Vakaso Secure Paste operates 100% in your local browser's volatile RAM. Your clipboard content, detected secrets, and pasted text are never transmitted to Vakaso, never logged to disk, and never shared with any external server.

1. Purpose and Operation

Vakaso Secure Paste is an automated developer safeguard designed to prevent accidental paste disclosure of API keys, authentication tokens, private keys, and database credentials into supported AI chat tools (including ChatGPT, Claude, Gemini, and Perplexity). The extension matches known secret patterns client-side and presents a warning modal with an option to redact sensitive tokens before they enter the host application's text editor.

2. Local RAM Processing & Zero External Transmission

When you paste text on a supported website:

Clipboard text is inspected transiently in memory using linear $O(N)$ regex scanning and Shannon entropy calculations.
No network requests (HTTP, WebSocket, or analytics beacons) are ever made by the extension.
Detected secrets and clipboard contents are completely wiped from volatile memory once the paste or redaction action completes or is dismissed.
The extension contains zero tracking cookies, zero analytics libraries, and zero advertising trackers.

3. Local Storage Usage (`chrome.storage.local`)

The extension requests the Chrome storage permission exclusively to maintain user preferences locally on your machine:

Master Toggle: Whether paste protection is active or temporarily paused.
Provider Categories: Which secret categories you have toggled on or off (AWS, OpenAI, Anthropic, GitHub, Stripe, Slack, Private Keys, Database Credentials, Bearer tokens).
Local Catch Counter & Referral Code: A numeric integer tracking total secrets caught locally to calculate the monthly quota tier, and an anonymous referral string (e.g., VK-XXXX) stored strictly on your device.

These settings remain strictly on your local machine and are never synced to our servers.

4. Scoped Website Matches

The extension operates only on the URLs where developers frequently interact with AI chatbots (specifically https://*.chatgpt.com/*, https://*.claude.ai/*, https://gemini.google.com/*, and https://*.perplexity.ai/*). It does not request broad permissions such as <all_urls>, does not access your browsing history, and does not inspect tabs on any other website.

5. Chrome Web Store Limited Use Compliance

Vakaso Secure Paste adheres strictly to the Google Chrome Web Store User Data Policy, including the Limited Use requirements:

We do not sell, rent, or monetize user data.
We do not use or transfer user data for personalized advertising, credit assessment, or training AI/ML models.
We do not allow humans to read user clipboard data.

6. Changes and Contact

If we update this Privacy Policy, the revised version will be published at this URL with an updated Effective Date.

If you have questions, feedback, or security inquiries regarding Vakaso Secure Paste, please contact us at: [email protected] or [email protected].