Privacy Policy

1. Who we are

PrivacyScrubber is operated by Ilya Sibiryakov, a sole proprietor (Osek Murshe) registered in Israel, and developed by the BrandMeWeb engineering studio. Ilya Sibiryakov is the data controller for the limited personal data described in Section 3.

This policy covers all PrivacyScrubber products: the web workspace at privacyscrubber.com, the Chrome Extension, the MCP server (@privacyscrubber/mcp-server), the Developer SDK (@privacyscrubber/sdk) and the TEAMS dashboard.

Privacy contact: support@privacyscrubber.com. We have not appointed a statutory Data Protection Officer; the controller handles privacy requests directly.

2. Content you sanitize stays on your device

Detection, masking, reverse scrubbing, OCR, PDF and Office parsing run locally in your browser tab, extension or local process. The scrub and reveal actions make no network requests and do not depend on any PrivacyScrubber server. The PrivacyScrubber architecture follows the ZTDS (Zero-Trust Data Sanitization) standard.

• Token maps. The map that links placeholders (for example [NAME_1]) to original values is held in memory and scoped to the browser tab that created it. See Sections 4 and 6 for exactly where copies are kept and when they are deleted.
• Files. Documents and images are read with the browser File API and parsed by bundled WebAssembly and offline parsing engines. Files are never uploaded.
• Session exports and TEAMS handoff. Exported .pssession files and handoff links are encrypted on your device with XChaCha20-Poly1305 using a key derived from your passphrase with Argon2id. We never receive the passphrase or the decrypted content.
• Audit receipts. Compliance receipts contain entity counts and categories, not the original values. They are hashed with SHA-256 for tamper evidence and rendered to PDF locally.

3. Personal data we do process

The website runs a small number of serverless functions on Vercel for billing, licensing and email. They never receive scrubbing content. The table lists every one of them and every other data flow to us.

We do not create user accounts or store passwords. The free Community tier needs no registration. We do not sell or share personal data, use it for advertising, or use it to determine creditworthiness.

4. Chrome Extension

The extension (Manifest V3) adds a sanitization shield to AI chat sites and a selection popover on other websites. All scanning happens inside your browser. The extension contains no remote code.

Permissions and why they are needed

• <all_urls> host access: lets the shield and selection popover work on any site where you choose to sanitize text (AI chats, Jira, Google Docs, CRM, webmail). Page content is read only locally and only to detect and mask sensitive data you are about to share.
• activeTab and scripting: inject the shield into the current tab and into sites you add manually.
• contextMenus: the right-click "Mask & Copy" action.
• clipboardRead and clipboardWrite: read text you copy for sanitization and write the sanitized result back.
• storage: save settings, license and per-tab token maps (details below).
• alarms: run a cleanup every 30 minutes that deletes token maps belonging to closed tabs.
• offscreen: run OCR and document parsing in an offscreen document so the page stays responsive.
• downloads: save sanitized files and audit receipts you export.
• Connection with privacyscrubber.com (externally_connectable): sync your license from the website to the extension.

What the extension stores on your device

• chrome.storage.session: token maps, including the original values, keyed by tab. This storage is held in memory by Chrome and is cleared when the browser closes. Maps for closed tabs are also removed by the 30-minute cleanup or immediately when you reset the session.
• chrome.storage.local: license key, settings, custom rules, blacklist, usage counters, the cached selector configuration (24-hour cache) and, if you configure one, a SIEM webhook URL. In browsers without chrome.storage.session (for example some Firefox and Safari versions), token maps fall back to chrome.storage.local and remain there until the cleanup removes them or you reset the session.

Network requests made by the extension

• Public configuration (selectors.json) and cryptographic revocation list (revoked-keys.json) from privacyscrubber.com (no identifiers sent).
• One-time legacy key migration service, only if you hold an older license key format.
• Optional SIEM / audit webhook. If you or your administrator enter a webhook URL, the extension sends event metadata (timestamp, platform name, count and categories of masked entities, company name) to that URL. It never sends original values or prompt text. The webhook goes to your organization's endpoint, not to us. It is off by default.
• When the extension is uninstalled, Chrome opens privacyscrubber.com/uninstall/, where you may leave optional feedback.

The use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. MCP Server and Developer SDK

• MCP server runs as a local subprocess of your IDE (Cursor, Claude Desktop, Windsurf, VS Code) over stdio. It opens no network connections and contains no analytics. Token maps live in process memory and are discarded when the IDE stops the server.
• Developer SDK is a library that runs inside your own application. It makes no outbound HTTP requests and verifies license keys offline with an embedded public key. Where token maps are kept is controlled by your code. When you use the SDK, you are the controller of the data it processes.

6. Browser storage and cookies on privacyscrubber.com

• Volatile Memory: the live token map for the current tab.
• sessionStorage: a tab-scoped backup of the token map so a page reload does not lose your session. The browser deletes it when the tab closes. "Reset Session" deletes it immediately.
• Encrypted Vault (IndexedDB): sensitive custom terms (names, project or partner names) encrypted with AES-256-GCM using a non-extractable WebCrypto key.
• Local Storage (localStorage): non-sensitive client preferences, offline license keys, active sector profile, custom user regex rules, interface theme preferences, local usage statistics, optional company name for audit receipts, and the cached license revocation list.
• Cookies: PrivacyScrubber sets no cookies. Paddle.js, loaded to provide checkout, may set cookies needed for payment and fraud prevention under Paddle's privacy policy.

You can delete all of this at any time by clearing site data for privacyscrubber.com or removing the extension.

7. Service providers

See also our subprocessor list and Data Processing Addendum.

8. Legal bases and retention

• Contract (GDPR Art. 6(1)(b)): purchases, license delivery, verification, pilots and invoices.
• Legal obligation (Art. 6(1)(c)): tax and accounting records held by Paddle and by us.
• Legitimate interests (Art. 6(1)(f)): aggregate analytics, security, abuse prevention and rate limiting.
• Consent (Art. 6(1)(a)): forms you choose to submit and the optional SIEM webhook.

Retention. Purchase and invoice records are kept for 7 years as required by Israeli tax law. License emails and support correspondence are kept while your license is active and for up to 24 months after it ends. Rate-limiting data lives only in function memory and disappears when the function instance stops. Vercel logs are kept according to Vercel's log retention for our plan (days, not months). Content you sanitize is never retained by us because we never receive it.

9. International transfers

The controller is based in Israel, which holds an adequacy decision from the European Commission. Providers in the United States and other countries receive data under the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU-US Data Privacy Framework, as offered by each provider.

10. Your rights

Depending on where you live (EU/EEA, UK, Israel, California and other US states), you can ask to access, correct, delete, restrict or port your personal data, object to processing based on legitimate interests, and withdraw consent at any time. We do not sell or share personal information as defined by the CCPA/CPRA and do not use automated decision-making with legal effects.

Send requests to support@privacyscrubber.com. We reply within 30 days. Data held only on your device (token maps, rules, vault) can be deleted by you directly at any time, and we cannot access it.

You may also complain to your local data protection authority, for example an EU supervisory authority, the UK Information Commissioner's Office or the Israel Privacy Protection Authority.

11. Compliance notes for organizations

• GDPR. Because content is sanitized on your devices and not sent to us, PrivacyScrubber does not act as a processor of that content. Your organization remains the controller. For billing data, we act as an independent controller.
• HIPAA. The Healthcare profile targets the 18 Safe Harbor identifiers (45 CFR 164.514(b)(2)). PrivacyScrubber does not receive protected health information and therefore does not act as a Business Associate. Your organization remains responsible for verifying de-identification results.
• SOC 2 / ISO 27001. Audit receipts can support your own controls evidence. PrivacyScrubber itself is not SOC 2 or ISO 27001 certified.

Automated detection can miss data. Review highlighted results before sharing text with any third-party service.

12. Verify it yourself

1. Open privacyscrubber.com, press F12, open the Network tab and enable "Preserve log".
2. After the page has loaded, disconnect from the network (Airplane Mode).
3. Paste text or drop a file and click Scrub. The tool keeps working and the scrub action records no network requests.

13. Security and children

Server functions use HTTPS, secrets are stored as environment variables, and license keys are signed with RSA. Local protections include AES-256-GCM vault encryption, XChaCha20-Poly1305 with Argon2id for exports and handoff, and per-tab isolation of token maps. No method protects data on a compromised device: keep your operating system and browser extensions trustworthy. Report vulnerabilities via our vulnerability disclosure policy.

PrivacyScrubber is a business tool and is not directed to children under 16. We do not knowingly collect their personal data.

14. Changes to this policy

This policy is versioned together with the product. Every release is checked against the policy before it ships: each network endpoint, server function, extension permission and third-party service in the release must be described here, and the policy version must match the release version. Material changes are announced on this page and in the extension release notes.

15. Contact

Ilya Sibiryakov (PrivacyScrubber), Israel · support@privacyscrubber.com

Policy Version: 2.4.0 · Effective Date: October 13, 2026