Sidecar Sieve

Flags supported sensitive-data patterns (keys, credentials, emails) in prompts to ChatGPT, Claude, Gemini — on-device.

Sidecar Sieve checks what you're about to send to ChatGPT, Claude, or Gemini, and flags things you probably didn't mean to paste — API keys, passwords, email addresses, phone numbers, names, addresses. You see what it found, decide what to remove, and send. Nothing leaves your browser until you say so. EVERYTHING RUNS ON YOUR DEVICE No accounts, no telemetry, no analytics. Your text is never transmitted anywhere. The detection model runs locally in your own browser. The only network request the extension makes while running is a one-time model download, verified against a fixed cryptographic hash before use. WHAT IT CATCHES Credentials and keys are always removed — API keys, cloud credentials, passwords, tokens. Contextual details are flagged for you to decide — names, employers, addresses, dates of birth, phone numbers, email addresses, government ID numbers. TWO REVIEW MODES Detailed review shows each item so you can pick. Quick confirm gives you a single yes/no prompt when something's flagged. WHAT IT DOESN'T DO This flags supported patterns — it isn't a guarantee that everything sensitive will be caught. Sidecar Sieve reads the text in the message box. It cannot read file attachments, images, or dictated speech, and it cannot read large pasted blocks that the chat site converts into an attachment rather than leaving as text. When any of these are present, Sidecar Sieve does not stay silent: the badge turns amber to tell you part of your message hasn't been checked, and you're asked to confirm before it sends. It won't scan that content — but it won't let it go without telling you. Detection of unchecked content is best-effort. These sites change their interfaces, and a change can create a gap until it's fixed. ON UNINSTALL If you remove the extension, Chrome opens a short feedback page. It receives the extension version, how many days it was installed, and whether you ever completed a redaction — no identifier, no account, and nothing you ever typed or scanned. The form itself is optional and asks for no personal details. PERMISSIONS - offscreen: runs the detection model separately from the pages you visit - storage: saves your settings - scripting: turns on protection in chat tabs you already had open when you installed - chatgpt.com, claude.ai, gemini.google.com: the three sites it runs on - huggingface.co: the one-time model download It does not request access to your browsing history, your identity, or any site other than the three chat sites it runs on.