Privacy policy
The short version: the Shadow Shield browser extension never sends the text of a prompt anywhere. Redaction happens inside the browser. The firm's control center receives only the kind of data found, the AI site, the action taken and the time.
Who we are
Shadow Shield is made by ozymandius.tech (Ezra Kewa), 121-6038 Birney Avenue, Vancouver, BC V6S 0L4, Canada. Questions about this policy: ezra.kewa@ozymandius.tech.
Shadow Shield is sold to law firms. The firm decides who is enrolled, and is responsible for telling its own staff that the extension is in use.
What the extension does
The extension runs only on the supported AI sites (currently chatgpt.com, claude.ai and perplexity.ai). When someone sends a prompt there, it checks the text on their own computer for Social Security numbers, payment card numbers, email addresses, phone numbers and the firm's own matter-number formats or client keywords. Anything found is replaced with a placeholder such as [REDACTED:SSN] before the prompt is sent. It does not read other websites, browsing history, files or anything else on the computer.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Redaction events: the AI site, the kinds of data found (for example "SSN"), the action taken and the time | The extension, each time it changes a prompt | The firm's audit log and reports |
| Daily counts of prompts checked, per AI site | The extension, every few minutes | Showing how much AI tools are used |
| A device token issued at enrollment | The firm's IT policy | Linking reports to the right firm |
| Staff email addresses, stored only as a keyed one-way code | The firm's administrator, when enrolling a device | Showing reports per person without showing names |
| The firm's matter-number formats and client keywords | The firm's administrator | So the extension can catch them |
| Email addresses of people who sign in to the control center | The firm's administrator | Sending one-time sign-in links |
What we never collect
- The text of any prompt, before or after redaction
- The values that were redacted (we record "SSN", never the number)
- AI responses, browsing history, or activity on any other website
- Advertising or analytics trackers. We don't sell or share data for marketing.
Where it is stored and who can see it
Data is stored by Supabase (database and sign-in, United States) and served by Vercel (United States). Only people the firm has added to its control center can see that firm's data. We access it only to run and support the service.
How long we keep it
We keep a firm's data for as long as the firm uses Shadow Shield. When a firm stops, we delete its data on request. A firm can also ask for a copy of its data at any time.
Changes
If we change what is collected, we will update this page and tell customer firms before the change takes effect.