Legal: Browser Extension

Privacy PolicyTracelet AI Security Audit (Browser Extension)

Effective date: 6 July 2026Last updated: 6 July 2026Publisher: Insighture

This Privacy Policy explains what the Tracelet – AI Security Audit Chrome extension (the “Extension”) accesses, how that data is handled, and the choices available to you. The Extension is a companion to the tracelet security platform. It captures interactions on supported AI assistant platforms and forwards them to the tracelet daemon running locally on the same device for security-policy evaluation.

In one sentence:the Extension sends captured data only to a program on your own computer. It does not transmit your data to Insighture or to any remote server.

1. Who this applies to

The Extension is intended for users of the tracelet security platform whose organization has deployed the tracelet daemon. It is of no use without the local daemon installed and running.

2. What the Extension accesses

When capture is enabled, the Extension reads the following from the supported AI platforms and passes it to your local tracelet daemon:

DataWhere it comes fromWhy
Message text: your prompts and the assistant's responsesSupported AI platform page / APISecurity-policy evaluation
Conversation ID, message role (user/assistant), model nameSupported AI platformContext and audit trail
File attachment metadata (name, size, MIME type) and content (up to 25 MB)AI platform upload flowsSecurity-policy evaluation
TimestampThe ExtensionOrdering and audit trail

Supported platforms: ChatGPT (chatgpt.com, chat.com), Claude (claude.ai), Google Gemini (gemini.google.com), and Perplexity (www.perplexity.ai). The Extension does not run on any other website.

Data categories (Chrome Web Store terms)

Because captured prompts and responses are conversational content, they fall into these declared categories:

  • Personally identifiable information: only to the extent you type such information into an AI prompt; the Extension does not seek out or single out PII.
  • Personal communications: your prompts and the assistant's replies are chat messages.
  • Website content: the message text read from the AI-platform page or API.

3. What the Extension does NOT collect

  • Authentication tokens, passwords, session cookies, or credentials.
  • Browsing history or any activity on websites outside the supported AI platforms.
  • Any data from pages not listed in the Extension's host permissions.
  • Personally identifiable information beyond what you yourself enter into the AI platforms.

4. Where your data goes

All captured data is delivered exclusively to the tracelet daemon process on the same machine, via Chrome Native Messaging (native host com.tracelet.agent). The daemon stores events in a local database on your device.

The Extension transmits no user data to any remote server. Its only outbound network request is a version check to tracelet-agent.s3.amazonaws.com, which fetches a public JSON version string for the “update available” banner and sends no user data.

Data retention, export, and deletion are governed by your tracelet daemon and platform configuration, not by the Extension.

5. How your data is used

Captured data is used solely to evaluate your AI interactions against your organization's security policies and to surface findings. It is notused for advertising, analytics, profiling, creditworthiness or lending decisions, or any purpose unrelated to the Extension's single purpose. It is not sold or transferred to third parties.

6. Remotely hosted code

The Extension executes no remotely hosted code. All scripts ship inside the Extension package; there is no eval, no external <script>, and no fetch-then-execute of code. The version-check response is treated as data and never executed.

7. Your controls

  • Capture toggle: turn capture off in the Extension popup to immediately stop all data collection.
  • Disable or remove: disabling or uninstalling the Extension in Chrome stops all collection.
  • Manage stored data: data already stored by the local daemon can be managed through the tracelet dashboard or by your platform administrator.

8. Data security

  • The Extension runs inside Chrome's extension sandbox.
  • Native Messaging is restricted to the specific tracelet daemon binary via the allowed_origins field of the native-messaging host manifest.
  • The Extension requests only the minimum permissions required for its function (storage, alarms, notifications, nativeMessaging) and runs only on the supported AI platforms.

9. Children's privacy

The Extension is an enterprise security tool and is not directed to children. It does not knowingly collect data from anyone under the age of 16.

10. Changes to this policy

If this policy changes materially, the Extension will be updated with a new version and the “Last updated” date above will be revised. Continued use after an update constitutes acceptance of the revised policy.

11. Contact

Questions about this policy or the Extension's data handling:

Back to tracelet.ai