← Back to API Key Leak Intercept

Privacy Policy

API Key Leak Intercept: Chrome Extension · Version 1.3.4 · Last updated: 12 November 2026

Who makes this

API Key Leak Intercept is built and maintained by Dario Cositore, an independent developer based in Castelleone, Italy. Contact: support@dariocositore.com

This page is the official privacy policy for the extension and the URL submitted to the Chrome Web Store. The Firefox build uses the same detection, the same network requests, and this same policy.

What the extension does

API Key Leak Intercept has a single purpose: it detects API keys, secrets, and personal data in text you are about to send from the browser, and warns you before it is sent.

It works by injecting a content script into supported websites (AI chat sites, or all sites in universal mode). The script monitors input fields for the Enter key or send button. Before the message is sent, it runs a set of regex patterns against the text. If a secret or PII is found, a modal appears with three options: Cancel (do not send), Send anyway (override), or Redact (replace secrets with typed placeholders like [API_KEY_1]).

All detection runs locally in your browser. Your text, your secrets, and the patterns themselves stay on your machine. Redacting replaces the secret in the message box with a placeholder before it is sent, so the extension does change the text when you choose that option.

Right after installation the extension opens a short welcome page built into the extension itself. It explains what the extension reads and asks you to turn protection on. Scanning stays off until you accept, and the page makes no network requests. Enterprise installs managed by policy start with protection on.

Personal mode (default)

In personal mode, which is the default, detection runs entirely on your device. Your message text and the secret values found in it are never transmitted anywhere. What leaves the browser depends on whether you are on the free plan or on personal Pro:

• Free personal: the only routine request is the daily signed configuration fetch, described under data transmission. No catch history is sent anywhere.
• Personal Pro: in addition to the configuration fetch and a license check, when a catch reaches a terminal action (blocked, sent anyway, or redacted) the extension posts catch metadata to the backend so it can appear in your account’s activity feed. The fields are: site hostname, page URL up to the path (the query string is dropped because it can carry tokens), secret type by name only, severity (high, medium, or low), the action taken, timestamp, extension version, the email on the license (or the one set in the extension), and, if you typed one, a justification of up to 140 characters. The secret value, any portion of it, and the message text are not in that payload. The backend stores the record in Cloudflare D1, under an account-scoped identifier derived from the license, and the console returns up to 500 entries. You can clear that log from the console. There is no automatic expiry in the current backend. A machine past the device limit (five per personal Pro key, unless the license says otherwise) is refused and that record is not stored.
• No analytics and no tracking.
• Settings (enabled/disabled, categories, custom patterns), the warning counter, the local audit log of the last 100 alerts, and, for Pro, the license key are stored in chrome.storage.local, which belongs to your browser profile
• If you turn team mode on and save notification channels, the webhook URLs, bot tokens, and API keys you enter are kept in the same local store in plain text

Team / IT mode (enterprise)

In team mode, which requires an organization ID provided by your IT administrator, the extension sends alert metadata to channels IT configures, and stores a copy on the backend for the IT dashboard, in addition to the configuration fetch, the entitlement check, and license verification.

What is sent:

• Organization ID and your email address (for attribution)
• The hostname of the site where the secret was detected (e.g., chatgpt.com) and the URL of the page up to the path. The query string is dropped because it can carry tokens, and the message text never leaves the browser
• The type of secret detected (e.g., "OpenAI API key", "AWS Access Key ID"), by name only
• Severity level (high, medium, or low)
• The action taken (blocked, sent anyway, redacted, warned), and whether it happened automatically or through the warning
• When the organization asks for one, the one-line reason the employee typed to override a warning (up to 140 characters)
• Timestamp in ISO 8601 format
• Extension version
• An install identifier the extension generates on its first run. It is a random string tied to that copy of the extension and nothing else, and it is what lets IT count seats per machine rather than per person
• Forwarding addresses saved in the team console are used by the backend to email a copy; they are not sent from the extension with each alert

What is never sent:

• The actual secret value or any portion of it
• The message text you were typing
• Your browsing history
• Your IP address inside the alert. Every server you contact can still see it in its own request logs
• Any other personal data beyond your email and the metadata listed above

Alerts are sent to channels IT configures: Slack webhooks, Microsoft Teams webhooks, Telegram bots, generic webhooks, email (via Resend), and the IT dashboard (Cloudflare Worker). The IT administrator controls which channels are enabled and where alerts go.

Alerts can also be forwarded to additional email addresses specified by IT or the employee (e.g., a manager or security team). A copy of every alert stays in the local audit log (last 100), and where the IT dashboard is in use the backend stores up to 500 alerts per organization.

Data collection summary

Personal free: Nothing is collected beyond the daily signed configuration fetch. Your text stays in your browser.

Personal Pro: Catch metadata (site, page URL up to the path, secret type, severity, action, timestamp, extension version, account email, optional justification) is sent to the backend and stored in Cloudflare D1, up to 500 entries, until you clear the log or ask for deletion. The secret value and the message text are never sent. A daily license check sends the license key and a per-install identifier.

Team mode: The same kind of alert metadata goes to IT-configured channels and to the backend (up to 500 alerts per organization, in Cloudflare D1). The secret value, the message content, and your browsing history stay out of it. A heartbeat, when enabled, reports that the install is running.

Data storage

Local (all modes): Everything the extension keeps lives in chrome.storage.local, which belongs to your browser profile. Settings, warning counter, Pro status and license key, team configuration (including any webhook URLs and tokens you save there), and the audit log of the last 100 alerts. Nothing here is synced to a server.

Backend (Pro and team mode): The Cloudflare Worker behind the IT dashboard holds license records (key, subscription ID, payer email, plan, cancellation date) and account records (email, a PBKDF2 password hash, and the Google account identifier when you sign in with Google; passwords are never stored in readable form). When team alerting is on, or when personal Pro relays a catch, it also holds up to 500 alerts per organization or personal Pro account in Cloudflare D1, plus the alert channel credentials the administrator saves in the portal (Slack and Teams webhook URLs, the Telegram bot token, custom webhook URL, forwarding email addresses) so alerts can be sent server-side. Accounts are only ever created through a verified checkout (Waffo Pancake or PayPal). The portal adds short-lived records: session tokens (7 days on activity, 30 days maximum), one-time set-password links (24 hours), and support messages, kept until you ask for deletion. Cancelled subscriptions keep a "Pro until" date so access runs to the end of the paid period.

Retention and deletion: Local data goes away when you clear it in the popup or uninstall the extension. Backend records are deleted on request. Email support@dariocositore.com and say which license key or organization ID is yours.

Data transmission

Detection, storage, and all processing happen locally. The extension still reaches the network in these situations:

• Configuration fetch (all modes): on install, when the browser starts, and once a day, the extension downloads a signed configuration from api.dariocositore.com. The configuration lists the AI chat sites the extension runs on and any sites to exclude. Detection patterns ship inside the extension, so the configuration cannot change what counts as a finding. The request carries no message data, no settings, and no identifiers beyond what any HTTP request carries (IP address and user agent in the server's standard logs). The response is checked against a signature built into the extension and is ignored if it does not verify.
• Entitlement check (team mode): when the browser starts and once a day, an install configured with an organization ID and organization token sends those two values to the backend and receives the Pro status of the organization. Personal installs never make this request.
• License verification (Pro): when you enter a license key in the popup, the extension sends that key and a per-install identifier to the backend (Cloudflare Worker) and gets back the tier and the email attached to the license. The same check runs when you open the popup and once every 24 hours while Pro is active, which is how a cancelled subscription turns Pro off, and how a sixth machine is told the device limit has been reached. A network failure never turns Pro off.
• Personal Pro catch history: when a catch is blocked, sent anyway, or redacted, the extension posts the metadata listed under personal mode to https://api.dariocositore.com/api/license/alert. The license key authenticates the request. The secret value is not included. A machine past the device limit receives an error and the record is not stored.
• Heartbeat (team mode): every 6 hours, when the team settings have heartbeat enabled, the extension reports to the endpoint IT configured (or to the backend) that the install is running. The report carries the organization ID and token, the email address set in team settings, the extension version, the install identifier that seats are counted against, whether the install was force-installed by policy, and a timestamp. Message data and detection results are not part of it.
• Team mode alerting: alert metadata (as described above) goes to the channels IT configured. Those are webhook URLs (Slack, Teams, generic), the Telegram Bot API, the Resend email API, or the backend IT dashboard.

If you uninstall, the browser opens a feedback page on this site. It carries the extension version and nothing about your browsing. Extension updates come from the install page, and from the Chrome Web Store once the listing is live. Payments run on Waffo Pancake's checkout, with PayPal available as a fallback. The backend receives the subscription events from the payment provider and keeps the license record they create. Nothing else is sent. The extension calls no analytics, tracking, or advertising endpoint.

The manage page on dariocositore.com is separate from the extension and does nothing until you use it. Pro accounts are created right after the payment is approved: the backend verifies the subscription with Waffo Pancake or PayPal, creates your account and license record (email, key, plan), and emails the key to the address on the order. The key is not shown during checkout and never sent to any other address; you can view it in the console after signing in. The purchase email also carries a one-time link for choosing your password; signing in later is email and password, or Continue with Google, in which case Google shares your name, email, and account identifier and we store the identifier and email. Sign-in creates a session cookie that lives 7 days in the backend and refreshes while you use it, up to 30 days. A support message you send from the portal is stored in the backend and emailed to the developer, and a confirmation copy goes to you through Resend.

Why the extension needs permissions

storage: To save your settings (enabled/disabled, categories, custom patterns), warning counter, Pro license key, team configuration, and audit log in chrome.storage.local.

alarms: To run the configuration check once every 24 hours, one license revalidation a day when a Pro license key is stored, and, in team mode, a heartbeat every 6 hours. Nothing else is scheduled.

scripting: To register the content script at runtime when Universal mode is on, or when an IT admin adds extra sites. The default install runs from a static declaration scoped to the AI chat list and uses no runtime registration.

Host permissions: Scoped to the AI chat sites listed in the manifest, Google included, to api.dariocositore.com, the extension's own backend, and to the three services that carry team alerts: api.resend.com for email, and the Microsoft Teams webhook hosts webhook.office.com and logic.azure.com. The content script watches the AI chat sites before a message is sent. The backend origin carries license verification, the configuration fetch, team alerts and the heartbeat. Detecting an enterprise force-install reads the extension's own install type and needs no permission of its own.

Optional host access (<all_urls>): Asked for in the popup only when you turn on Universal mode, and only for the sites an IT admin adds on top of the list. Declining changes nothing: Universal mode stays off and the extension keeps running on the AI chat list alone.

Optional host access (hooks.slack.com, api.telegram.org): Asked for when a team install has Slack or Telegram alerts enabled, so the extension can deliver those alerts from the browser. Declining means those two channels stay silent; other channels and the backend relay are unaffected. A generic webhook asks for the host of the URL IT configured.

Third parties

No user data is sold or transferred to third parties for commercial purposes. Nothing here is used for advertising or profiling.

The infrastructure providers that process data when you use paid or team features are:

• Cloudflare, Inc. (United States / EU edge): hosts the backend Worker and Cloudflare KV storage for license verification, portal sessions, and team alert metadata (capped at the latest 500 alerts per organization).
• Waffo Pancake (Waffo, Inc.): processes card payments as merchant of record and notifies the backend when a subscription activates, renews, or cancels.
• PayPal (PayPal Holdings, Inc.): processes subscription payments made through PayPal and notifies the backend when a billing agreement activates, renews, or cancels.
• Resend (Plus Five Five, Inc.): delivers transactional license key emails, support confirmations, and optional team email alerts.

In team mode, alerts also go to the webhook destinations your IT administrator explicitly configures (Slack, Microsoft Teams, Telegram, email, or custom SIEM webhook), where your employer acts as the data controller.

The IT console and dashboard are authenticated by your license key or organization admin key. Treat your license key, admin key, and organization ID like credentials, and clear or delete your organization's alert log at any time from the manage portal or by emailing support@dariocositore.com.

Children

The extension is not directed at children under 13. Message text and secret values are never collected from anyone. In personal Pro and in team mode, only the metadata described on this page is transmitted, and team mode is intended for an enterprise context where children are not the users.

Changes to this policy

If the extension's data practices change in a future version, this page will be updated before that version is published. The last-updated date at the top of this page reflects the current version.

Your rights under the GDPR

The developer is the data controller for everything described here except team-mode alert data, where your employer controls the data and this extension is the tool.

You can ask for a copy of the personal data held about you, have it corrected or deleted, restrict or object to its processing, or receive it in a portable format. Write to support@dariocositore.com. Requests are answered within 30 days. If the answer does not satisfy you, you can complain to the Garante per la protezione dei dati personali, the Italian data protection authority.

The legal basis for the backend records is legitimate interest in delivering the product you bought or asked for: license verification, subscription events, team alerting. Nothing here involves automated decision-making.

Contact

Questions about this privacy policy or the extension's data practices: support@dariocositore.com

This policy can also be reached from the extension's homepage at dariocositore.com/tools/api-key-leak-intercept/.

Chrome Web Store required disclosures

The following disclosures are required by the Chrome Web Store Developer Program Policies and are certified as true: