Privacy Policy
Effective date: September 2026 · Applies to the Lostop browser extension and its local companion server
Lostop checks your text on your own computer to look for secrets before you send them to a GenAI chat tool — nothing you type is ever sent to us, stored on our servers, or shared with any third party, because we don't operate any server that receives it.
01What Lostop does
Lostop is a browser extension that monitors the text you type into supported GenAI chat websites (chatgpt.com, claude.ai, deepl.com). Before your message is sent, the extension forwards that text to a small server application (the "local server") that runs entirely on your own computer — not on a server we operate. The local server checks the text against a set of patterns designed to detect secrets such as API keys, private keys, database credentials, and card numbers, and tells the extension whether to allow or block the message.
02What data the extension processes, and where it goes
Because Lostop's entire purpose is to inspect text before it's sent, it necessarily has access to the content you type. The table below is a complete, honest account of what that involves.
| Data type | What happens to it |
|---|---|
| Website content / chat messages you type | Read by the extension, sent only to http://localhost (the local server on your own machine) for pattern matching. Never sent to any server we operate. |
| Authentication information (API keys, passwords, tokens) | This is what Lostop is designed to detect. If found, it is masked (partially hidden) before being written to a database file that lives only on your computer. |
| Financial information (card numbers) | Checked locally against a mathematical validation (Luhn algorithm) to reduce false positives. Masked before local storage, never transmitted anywhere else. |
| Extension settings (e.g. protection on/off per site) | Stored locally in your browser via chrome.storage.local. Not synced to any external service. |
The local server that scans your text runs as a program on your own computer, listening only on localhost. It is not a service we host, monitor, or have access to. We — the developers of Lostop — never receive, see, or store any text you type, any secret that gets detected, or any incident log. There is no analytics pipeline, no telemetry, and no remote database.
03Local storage of incidents
When the local server detects a likely secret, it records an entry (timestamp, the type of secret found, and a partially masked snippet — e.g. AKIAIO**************) in a local database file (incidents.db) stored on your own computer, next to the server program. This log exists so you can review what was blocked, for example through the optional local dashboard. This file is never transmitted anywhere; you can delete it at any time by deleting the file itself.
04Third parties
Lostop does not sell, rent, or transfer any data to third parties. The extension does not include any third-party analytics, advertising, or tracking code. The only network request the extension makes is to the local server described above, which runs on localhost — your own computer.
05Permissions the extension requests, and why
- Access to chatgpt.com, claude.ai, and deepl.com — required to read the text in the chat input field so it can be checked before sending.
- Access to localhost — required to send that text to the local server on your own machine for checking.
- Storage — required to remember basic extension settings (such as whether protection is enabled) locally in your browser.
06Children's privacy
Lostop is a productivity and security tool intended for general audiences, including developers and business users. It is not directed at children, and we do not knowingly collect data from children, in line with the fact that we do not collect data from any user at all.
07Changes to this policy
If this policy changes, the updated version will be published at this same URL with a revised effective date at the top of the page.
08Contact
Questions about this policy or the project can be raised via GitHub Issues, or by reviewing the source code directly at github.com/wowkamran/lostop.