Stop pasting secrets into ChatGPT & other AI chats.

Open Chrome DevTools → Network tab → filter by the extension ID. Paste anything sensitive. You'll see zero outbound requests. Our manifest declares no host_permissions for any remote origin. Only the 12 AI chat sites the content script runs on, and we never send their contents anywhere. The detection rules are published at github.com/Matteo-Coder2/pasteguard-rules so you can audit exactly what we look for.

Cold-start payload is 44 KB (14 KB gzipped). Detection runs in under 20 ms on a typical paste. The modal's React tree only loads when a finding actually triggers. Most pastes pay zero cost. We hook the paste event at the document level (not site-specific selectors), so when ChatGPT redesigns their UI, Heedful keeps working.

The core (75+ detectors, all 12 sites, industry presets, file scanning) is free forever. Not a 14-day trial. We make money from Pro ($4.99/mo) which adds the on-device semantic layer, unlimited custom rules, and priority support. We literally cannot sell your data because nothing leaves your device. No tracking, no analytics, no account required. Full stop.

Those are enterprise tools sold with annual contracts. Most importantly: they're cloud DLP. To classify your text they route it to their servers, which means your secret is now in two places instead of one. Heedful is on-device, no contract, designed for the individual worker without a corporate IT department. We're not the right tool for SOC2-compliant orgs; for everyone else we're more truthful about the privacy model.

Heedful intercepts paste, typed-text-then-Enter, and Send-button clicks. It also scans text, PDF and Word files you drop onto the Scan page before uploading. If you drag a screenshot of a customer dashboard into ChatGPT, we don't scan the image. If you dictate a customer name via voice, we never see it. We're a smart safety net for keyboard, clipboard and document input. Not a full compliance product. Combine with judgment.

Out of the box, the 75+ built-in detectors cover secrets, US PII, and national identifiers across 16 countries. Six industry presets (HIPAA, PCI DSS, SOC2, GDPR, Financial, Legal) let you turn on the right detectors for your regulatory context in one click. For identifiers specific to your organisation, add a custom regex rule in Options — the live tester verifies it before saving. Heedful is a personal safety net, not a compliance certification.

Grok opens as a sidebar inside x.com that can appear on any URL (a tweet, a profile, the timeline). To protect that sidebar, the content script has to load on every x.com page. But the actual scanning is gated to composers with Grok-specific markers. Tweet drafts and reply boxes are explicitly ignored. We never read their contents. The full caveat is in our privacy policy.

Click "Add to allowlist" on the row once. We won't flag that exact text again on any site. Or click "Ignore for this session" for a one-tab pass. There's no nag, Pro is mentioned once in the Options page and never interrupts a paste flow.

It requires Chrome 138+ and either a discrete GPU with more than 4 GB VRAM, or 16+ GB of RAM with a modern CPU. About 22 GB of free disk is also needed for Chrome's local AI model. On unsupported hardware, the 25 regex detectors still work. Only the AI-based detectors (customer name, codename, confidential signal) degrade. The extension is honest about which detectors are unavailable on your machine.

The detection rules are MIT-licensed and live in a public GitHub repo. They survive us. The extension binary lives on Chrome Web Store and stops getting updates if we abandon it; you can still use the last-published version. We have no plans to sell to a data-mining company; if that ever changes, the rules repo is the fork-friendly escape hatch.

Yes. Managed Chrome installations can list installed extensions by ID. We don't hide. If your organization has an extension allowlist and Heedful isn't on it, ask IT to add the extension ID. We're not designed for stealth use against employer policy.