CamPrompt Privacy Policy
This policy describes what CamPrompt collects, what it never collects, and how data is handled. It is written for two audiences: the end user (who installs the extension) and the administrator (who deploys it to managed devices). For regulated customers (healthcare, insurance), this document is the data-handling reference that pairs with the HIPAA control mapping maintained internally by the vendor.
1. What CamPrompt is
CamPrompt is a local, zero-server browser extension. It scans text that the user types, pastes, or drops into the composer of a supported AI chat site (ChatGPT, Claude, Gemini, Copilot) on the user's own device, before the message is submitted. It does not send prompt text to any server, cloud, or third party.
2. What CamPrompt never collects
- Prompt text. The content of the user's chat composer is never transmitted, logged, or stored outside the device. The extension has no network permission for prompt data.
- Conversation history. CamPrompt does not read, store, or transmit past conversations.
- User identity. The extension does not collect the user's name, email, or account credentials.
- Browsing history. The extension does not track or report which pages the user visits outside the supported chat sites.
3. What CamPrompt stores locally
All storage is in chrome.storage.local, scoped to the extension's origin. Nothing is stored in cookies, IndexedDB, or any other browser storage mechanism.
| Key | Content | Retention |
|---|---|---|
camprompt.config | User's policy configuration (per-site toggles, confidence tiers, custom patterns). Does not include prompt text. | Until the user changes it or uninstalls. |
camprompt.findings | Metadata for the most recent detection events: rule ID, category, site, action taken, timestamp, and a redacted preview (first 8 characters of the matched value, e.g. sk-a1…). Never the full matched value. | Last 50 events, FIFO. |
camprompt.audit | Hashed audit log entries: timestamp, rule ID, site, action, user action (sent / blocked / justified). SHA-256 hash chain for tamper detection. No prompt text. | Until the user clears it or uninstalls. |
camprompt.first-run | Per-site first-run flag (boolean). | Until the user clears it or uninstalls. |
4. Managed policy (administrator-deployed)
When deployed through Intune or a local policy file, the administrator supplies a JSON policy that is read from chrome.storage.managed. This policy contains rules, thresholds, and toggles only — no user data. The policy is applied locally; it is not transmitted anywhere.
5. Telemetry (optional, administrator-enabled)
Telemetry is off by default. When an administrator enables it by setting telemetry.endpoint in the managed policy, the extension sends metadata-only events to that HTTPS endpoint. The amount of detail is controlled by telemetry.evidenceTier (default 2); tier 3 additionally requires telemetry.tier3Acknowledged.
Every finding event carries (tier 1, always present):
- Pseudonymous identifiers —
tenantId,deviceId,userId— so an administrator can correlate events across a fleet. By default these are pseudonymous: they do not carry a name, email address, or other directly identifying information. - The rule that fired (
ruleId,ruleName), its category, and its severity - The site (
site) - The action taken (
allow,redact, orblock) and whether it ran in audit mode (auditMode) - What the user did next (
userDecision:edited,overrode,cancelled, ornone) - A UTC timestamp (
ts) and the extension version
Tier 2 (the default) adds a structural fingerprint: the matched value's length, its character-class pattern (digits, letters, punctuation), and its position within the prompt. No character of the original value survives.
Tier 3 (opt-in, requires explicit acknowledgment) adds a scrubbed context window: up to ±40 characters around the match, with every finding in that window replaced by its placeholder. The window is re-scanned after scrubbing and dropped entirely if it still yields any finding.
Coverage-health events report adapter and policy lifecycle (for example adapter.composer-not-found or policy.absent) so the dashboard can show coverage, not just findings. They carry no user content and no evidence tier.
Never sent: the prompt text, the matched value itself, and no hash or HMAC of a matched value — a SHA-256 of a 9-digit SSN is brute-forced in seconds. Conversation content and any field that could reconstruct the user's input are never sent.
The endpoint URL is set by the administrator and is under the administrator's control. The extension does not phone home to any Cameron Sky server by default.
6. Permissions
The extension requests the minimum permissions required for its function:
| Permission | Why |
|---|---|
storage | Read/write local configuration, findings, and audit log. |
notifications | One-time install notification. |
alarms | Wake the background service worker on an interval to drain the optional telemetry queue; MV3 service workers are ephemeral and cannot rely on plain timers. |
| Host permissions (4 sites, 6 domains) | Inject content scripts into the supported chat sites to intercept the composer before submit. |
The host footprint is limited to 6 domains across the 4 supported sites: chatgpt.com, claude.ai, gemini.google.com, copilot.microsoft.com, m365.cloud.microsoft, and copilot.cloud.microsoft (the last three are all served by the single Copilot adapter). No other sites are accessed.
7. Data sharing
CamPrompt does not share data with any third party. There is no analytics vendor, no crash reporter, no advertising network, and no data broker.
8. Data retention
All local data is retained only on the device where the extension is installed. Uninstalling the extension removes all chrome.storage.local data. There is no server-side retention because there is no server.
9. Children's data
CamPrompt is a business tool intended for use by adults in a work environment. It is not directed at children and does not knowingly collect data from anyone under 13.
10. Changes to this policy
Material changes to this policy will be noted in the release notes and, where applicable, in the Chrome Web Store listing. The version and effective date at the top of this document reflect the latest revision.
11. Contact
Questions about this policy or about CamPrompt's data handling should be directed to the administrator who deployed the extension, or to Cameron Sky at support@cameronsky.com.