DRAFT — needs counsel review. This is a working draft, not Sight4's published policy. Don't rely on it yet.

Privacy policy

Effective date: TODO

Who we are

Sight4, LLC ("Sight4", "we", "us") makes the Sight4 browser extension and the Sight4 desktop helper for AI coding tools. You can reach us at info@sight4.com.

The short version

• Sight4 checks what you're about to send to an AI tool on your own device.
• Your prompts, pastes and files are never sent to Sight4. We don't have a server that receives them.
• Sight4 doesn't decrypt or intercept your internet traffic.
• There's no Sight4 account, no analytics and no tracking in the extension, the desktop helper or this website.
• What Sight4 keeps (settings, and short records of the kind of data it found) stays on your device, and you can delete it.
• Anything you choose to send to an AI site or tool still goes to that company, just as it would without Sight4. Their privacy policy covers it, not ours.

The browser extension

What it does

The extension checks prompts on ChatGPT (chatgpt.com), Claude (claude.ai), Gemini (gemini.google.com), Grok (grok.com, and Grok inside X at x.com/i/grok), Kimi (www.kimi.com and kimi.moonshot.cn) and Muse (muse.ai). When you send, paste or drop text into the prompt box, it looks for things like API keys, passwords, payment card numbers, bank account numbers (IBAN), Social Security numbers, and, on the Strict setting, email addresses and US phone numbers. If it finds one, it stops the send or asks you to check first. If you turn on "Check attached files" (off by default), it also checks files you attach on those sites.

On x.com the extension is allowed to run on the whole site, because X loads Grok without a full page change. It checks nothing and records nothing outside Grok.

How your data is handled

• Prompts and pasted text are read inside the extension on your device, checked, and then dropped. They're never stored, logged or sent anywhere by Sight4.
• Attached files (only with file checks on) are read on your device for one check: the first few bytes, a ZIP file's list of file names, the text of a text file up to 4 MB, or a small scaled-down copy of an image. File names are used only to spot medical-image words and file types. Nothing from a file is stored or sent.
• Sight4's notices never show the data they found, only what kind it was (for example "Payment card number").

What it stores, and for how long

Everything below is kept in your browser's own extension storage on this device. None of it is uploaded.

• Your settings: the protection level (Balanced or Strict) and whether file checks are on. Kept until you change them or remove the extension.
• This session's counts: how many times Sight4 warned or blocked, per site and per kind of data, and whether each open tab is protected. Kept in memory only and cleared when you quit the browser.
• Your choices on "possible" passwords: when Sight4 blurs something that might be a password and you choose to keep or remove it, it records the day (not the time), the site, the kind of data and your choice. Never the value. Kept for 7 days, then deleted automatically. The extension's menu shows these records and has a Clear button.

What it never does

• It makes no network connections of its own. The security policy on its pages blocks them, and our build checks reject network code in the part that runs on AI sites.
• It doesn't download code or rules. The detection rules are built in.
• It has no analytics, ads or tracking, and doesn't read your browsing history.
• Its code runs only on the AI sites listed above (on x.com it loads site-wide but acts only in Grok), and on Google Search if you turn on the switch below.

Hiding Google's AI answers (optional)

The extension has a switch, off by default, that hides AI Overviews and links into AI Mode on Google Search. When you turn it on, your browser asks you to give Sight4 access to www.google.com. When you turn it off, that access is removed. The switch doesn't store anything: the browser permission is the setting. On Google, Sight4 reads the results page in your browser only to find those AI panels and hide them. It doesn't record your searches or send them anywhere. Google can tell that an extension hid something on its page.

What the AI site can still see

The AI site's own page can read what you type in its prompt box, even before you press send and even when Sight4 stops the send. It can also tell that a Sight4 notice appeared and what you clicked, but not what the notice says. Sight4 can't prevent this, and the AI company's own privacy policy applies to it.

The desktop helper for AI coding tools

The Sight4 desktop helper (a command-line program called aisec) runs on your computer as you, without administrator rights. It plugs into the hook settings of Claude Code and Cursor, so those tools ask it to check each prompt before sending, check which MCP servers and tools the AI wants to use, and check what those tools send back.

• No traffic interception. It doesn't decrypt, proxy or inspect your internet traffic. It only sees what the AI tool hands it through the tool's own hook feature.
• Nothing is uploaded. The helper makes no network connections.
• Your prompts aren't written down. Prompt text, the values it finds and your custom keywords are never written to its logs or output.
• A short local log. For each decision it writes a line to a log file on your computer: the tool, the action taken, the protection level, the kinds of data found and how many, the MCP server and tool name (with anything that looks like a secret or your custom keywords replaced), a fixed reason code, the rule version, and the time. The file is readable only by your user account and is capped at about 1 MB, with one older file kept (on Windows, it can grow past that if another program holds the file open).
• Settings and backups. Your policy file and a backup of the few hook settings it changes in Claude Code or Cursor are kept in the same folder. It copies only the hook settings it changes, never your env or apiKeyHelper entries. If one of your existing hook commands contains a secret, the backup holds that line too.

The log and settings live in ~/Library/Application Support/Sight4/aisec/ on macOS, %LOCALAPPDATA%\Sight4\aisec\ on Windows and ~/.config/Sight4/aisec/ on Linux. Deleting that folder deletes everything the helper keeps.

The helper also has an inventory command that lists AI tools, MCP servers and browser extensions on your computer, the programs connected to AI services, and five security settings (like disk encryption and firewall). It runs only when you run it, shows the result to you, and doesn't send it anywhere.

Claude Code and Cursor keep their own history of your prompts. That's controlled by those tools, not by Sight4.

This website and the waitlist

• This site sets no cookies and uses no analytics, trackers, ads, third-party fonts or third-party scripts.
• The company that hosts the site may keep standard server logs (such as IP address, browser type and the page requested) to run and protect the service.
• Waitlist. To join, you send us an email. We get your email address and whatever you write. We use it only to tell you about Sight4 early access and to answer you. We don't sell it or share it for advertising, and we'll delete it if you ask.

The portal (not built yet)

We plan a portal where a household or a small business can see which devices are covered and set the same protection for each. It doesn't exist yet. Before it launches, we'll update this policy to say exactly what it collects.

Our design goal is that prompts and what you write never reach Sight4, and that anything that does pass through Sight4 is protected so that Sight4 itself can't read it. We'll describe how when it ships, and we won't start sending anything new without updating this page first.

Children

Sight4 doesn't collect personal information from anyone, including children, through the extension or the desktop helper. The waitlist is for adults; we don't knowingly collect email addresses from children under 13. If you think a child has emailed us, write to info@sight4.com and we'll delete it.

Your choices and rights

• Extension data: use Clear in the extension's menu, or remove the extension, which deletes everything it stored.
• Desktop helper data: delete the folder listed above. Running aisec hooks uninstall removes its hook entries from Claude Code and Cursor.
• Waitlist: email info@sight4.com to see, correct or delete what you sent us. We'll answer within 30 days.

Depending on where you live, you may have more rights over your personal information, such as the right to access, correct, delete or move it, or to object to how it's used. For Sight4, those requests cover the emails you send us and any server logs our web host keeps. We don't sell or share personal information for advertising.

Security

The safest data is data we never receive, so Sight4 is built to keep your prompts on your device. The extension's pages block network access, and our build fails if network code gets into the part that runs on AI sites. The helper's log file is readable only by your user account. No system is perfect: if you find a security problem, please tell us at info@sight4.com.

Changes to this policy

If we change what Sight4 collects, we'll update this page and the effective date before the change ships. For a significant change, we'll also say so in the extension's release notes and email the waitlist.

Contact us

Sight4, LLC · info@sight4.com