1. Who we are

Route19 (Pty) Ltd, registered in South Africa, trading as Route19.io. Privacy questions: privacy@route19.io

2. What data the extension processes

The extension processes the following locally on your device only — none of this leaves your browser:

• Text you type into supported AI tools, to detect sensitive data patterns
• Text in clipboard paste events, when clipboard protection is enabled
• File content from uploads you initiate, to scan before upload
• Page URL and hostname, to apply the correct site settings

3. What data is stored locally

• Settings and preferences — tier, enabled packs, toggle states
• Session statistics — aggregate counts only, no prompt content
• Detection event log — Protect+ and above: category, risk score, timestamp, site. No prompt text stored.
• License key — stored in Chrome sync storage if you have a paid subscription
• License validation cache — result cached locally for up to 4 hours

4. License validation

If you have a paid subscription, the extension periodically calls our license API to verify your key. This request sends only your license key — no usage data or prompt content. The result is cached for 4 hours. If unreachable, the extension uses the cached result for up to 24 hours before downgrading to the free tier.

5. Payments and billing

Payments are processed by Paddle (paddle.com), our Merchant of Record. Paddle collects your payment details and email in accordance with Paddle’s Privacy Policy. Route19 receives only your email and subscription status.

6. Chrome permissions

Permission	Purpose
storage	Save settings, statistics and license key locally on your device
activeTab, tabs	Detect which site is active and apply the correct detection settings
scripting	Inject the content script that scans text inputs on supported sites
notifications	Show browser notifications for high-risk detections when enabled
Host permissions (45+ sites)	One per supported AI tool or platform. Access is limited to reading user-typed text for DLP scanning only.
www.google.com	Google Search routes queries through Gemini AI (AI Mode, AI Overviews). The extension scans only the search input field — not results, account data, or any other Google product.

7. Data sharing

We do not sell or share your data. The only exceptions are Paddle for billing, and Cloudflare whose infrastructure hosts our license API (standard request metadata only — no prompt content).

8. Your rights

You may request a copy of data we hold, deletion of your account and license record, or correction of inaccurate information. Contact privacy@route19.io. We respond within 30 days.

9. Children

PromptGuard is not directed at children under 13. We do not knowingly collect information from children.

10. Contact

Route19 (Pty) Ltd  ·  privacy@route19.io  ·  promptguard.route19.io