PrivacyScrubber
PrivacyScrubber masks personal data in prompts, code and documents before they reach ChatGPT, Claude or Gemini. Detection and tokenization run entirely in browser RAM, and a single click restores the original values once the model has answered.
What is PrivacyScrubber?
PrivacyScrubber is a client-side redaction layer that sits between you and any large language model. Rather than routing text through a vendor cloud to be cleaned, it finds and replaces sensitive values inside your own browser's memory using JavaScript and WebAssembly. The company calls this Zero-Trust Data Sanitization, and it invites you to check the claim instead of accepting it: turn on airplane mode or watch the Network tab in DevTools, and the tool keeps working with no outbound requests at all.
The masking is reversible, which is what separates it from ordinary redaction. A client becomes [NAME_1], a card number becomes [CARD_1], and the mapping is held in volatile RAM. You paste the tokenized prompt into ChatGPT, Claude or Gemini, paste the answer back, and click Reveal to turn the placeholders into real values again on your own machine. Blacking text out would destroy the context a model needs to reason; tokenization keeps the structure intact while hiding the identities.
Detection pairs regular expressions with the compromise.js NLP library, contextual validation maps and stop-lists, plus an optional local machine-learning model of roughly 35 MB for harder cases. Over fifty entity types are grouped into more than twenty industry profiles — Medical PHI, Legal, Finance, DevOps, HR, Insurance, Accounting, Pharma and more — so a clinician and a site reliability engineer get quite different detectors from one engine.
Four surfaces share that engine. The web workspace needs no account or installation and handles pasted text along with .txt, .docx, .xlsx, .csv, PDF and images through offline OCR. A Chrome extension masks in-page as you type across nine chat interfaces. A local MCP server plugs into Cursor, Windsurf and Claude Desktop so an IDE never hands raw code to a model. An npm SDK exposes .scrub() and .reveal() for CI/CD and RAG pipelines.
Because nothing is transmitted, the vendor argues there is no processor to contract with — no DPA, no BAA, no vendor security review. Teams pay a flat $99 a month for unlimited seats, with regex rules an administrator can lock and push through MDM.
What it does
- Replace names, emails, IDs, card numbers and API keys in a prompt before it reaches any AI model
- Restore the real values inside the model's reply with one click
- Sanitise local documents — .txt, .docx, .xlsx, .csv, PDF and scanned images — without uploading them
- Mask sensitive text as you type directly inside ChatGPT, Claude, Gemini and six other chat interfaces
- Filter what an IDE such as Cursor or Claude Desktop can send, through a local MCP server
- Audit a code directory for hardcoded secrets, JWTs and personal data before an agent reads it
- Produce a SHA-256 audit receipt evidencing that no confidential bytes left the device
When to use PrivacyScrubber / When not to
A quick filter to help you decide if PrivacyScrubber is the right fit.
When to use PrivacyScrubber
- Lawyers, paralegals and contract managers who need AI on depositions, agreements and case files without waiving privilege
- Clinicians and health information staff summarising records that carry the eighteen HIPAA identifiers
- Developers and DevOps engineers who paste crash logs, .env files and database strings into Cursor or ChatGPT
- CISOs and GRC teams trying to govern shadow AI across a fleet without deploying a proxy
- Finance, HR and insurance staff handling salaries, account numbers, claims and candidate records
When not to use PrivacyScrubber
- Teams needing network-wide DLP across SaaS databases and email, which is what Purview or Nightfall are built for
- Engineers building a Python backend redaction pipeline, a job the site itself hands to Microsoft Presidio
- Organisations wanting a named legal entity, a registered address and an Article 27 representative before signing anything
- Anyone working mainly in non-Latin scripts, since the default profile is tuned for English names
- Buyers who want an audited, certified product rather than a claim they are invited to test themselves
How to use PrivacyScrubber
A typical end-to-end flow, from setup to results.
- Open the workspace at privacyscrubber.com — no account, no installation, nothing to configure
- Pick the detection profile that matches your work, such as Legal, Medical PHI, Finance or DevOps
- Paste your text, or drag in a document, spreadsheet, PDF or photograph for offline OCR
- Click Scrub and check the highlighted results, since the vendor recommends verifying rather than trusting
- Copy the safe output and send it to ChatGPT, Claude, Gemini or whichever model you use
- Keep the tab open, because the token map lives in RAM and disappears when the page reloads
- Paste the model's reply back and click Reveal to restore the real names and numbers locally
- Export the session as an encrypted .pssession file if you need to come back to it later
- Install the free Chrome extension to mask as you type in-page, using Alt+Shift+X or the right-click menu
- For engineering work, add the MCP server to your IDE config with npx @privacyscrubber/mcp, or install the npm SDK
Pros & Cons
Pros
- The central claim is testable in a minute: cut the network and the tool still works
- No processing agreement, business associate agreement or vendor review to clear before use
- Tokenization is reversible, so the model's answer stays usable instead of being full of black boxes
- One engine across web, browser extension, IDE and SDK, with the same rules applied everywhere
- Flat $99 a month for unlimited TEAMS seats, with no per-seat charge as the team grows
- The free tier is genuinely usable at 15,000 characters per prompt and needs no account
- A $110 lifetime licence exists as an alternative to the monthly PRO subscription
Cons
- No legal entity, postal address or governing jurisdiction is published anywhere on the site
- No Article 27 EU representative and no data protection officer, despite explicitly courting European teams
- SOC 2, ISO 27001 and HIPAA appear as frameworks the tool helps you satisfy, not as certifications it holds
- Support is the single published contact address, with no legal or privacy channel
- Detection is tuned for English; other scripts may need custom regex rules
- Reloading or closing the tab destroys the session map, and with it the ability to unmask
- Social proof is hard to verify: testimonials are declared composite and the aggregate rating is unsourced
Pricing & Plans
A permanent free plan is available without an account, covering the core entity types up to 15,000 characters per prompt. The cheapest paid entry point is PRO at USD 15.00 per month, also offered as a USD 110.00 one-time lifetime licence. TEAMS costs a flat USD 99.00 per month for unlimited seats, and ENTERPRISE pricing is quoted on request. All purchases carry a fourteen-day money-back guarantee.
- core detection for names
- emails and phone numbers
- up to 15
- 000 characters per prompt
- a three-page PDF test and three OCR scans per session
- with one-click reveal
- in-page masking inside ChatGPT and Claude
- batch processing of 50+ files
- 22+ industry profiles
- offline PDF and OCR scanning
- bulk reveal for CSV exports
- MCP protection for Cursor and VS Code
- custom regex rules
- token labels and SHA-256 audit receipts
- unlimited seats
- strict CISO lock on the extension
- local employee rules layered over locked company rules
- encrypted session handoff between colleagues
- one-link Blueprint deployment and organisation-wide compliance receipts
- fully air-gapped operation for defence and banking
- centralised MDM rollout across 10
- 000+ seats via Google Workspace Admin
- Microsoft Intune or Jamf
- full source code licence and private npm distribution
- dedicated GRC onboarding
- pre-filled SIG and CAIQ questionnaires and a custom DPA
Data, GDPR & hosting
A consolidated view of how PrivacyScrubber handles your data.
GDPR overview
Substantial and specific. The site claims GDPR compliance outright and names the provisions it targets: Article 25 privacy by design, Article 32 security of processing and Article 5(1)(c) data minimisation, with a dedicated page arguing that local pseudonymisation also avoids Schrems II transfer exposure. HIPAA Safe Harbor, SOC 2 CC6 controls, ISO 27001 A.8.11, NIST 800-53 and the EU AI Act are addressed alongside. The vendor maintains it is not a data processor, so no DPA is needed with it, while offering custom agreements at enterprise level. Two gaps are worth naming: no Article 27 EU representative is designated anywhere, and no data protection officer or dedicated privacy contact is published — support is the only address on the site.
Who owns the data?
You do. The vendor's position is architectural rather than contractual: nothing you scrub is transmitted, so there is nothing for it to own, sell or disclose. The privacy policy states that no text you paste, no file you upload and no detected entity ever leaves your machine, and that a breach of the PrivacyScrubber domain would expose only static hosting assets. The session map that makes unmasking possible lives in volatile RAM, never in localStorage or IndexedDB. The terms go further and argue the company is not a data processor at all. In exchange, the policy places responsibility on you to confirm the masked output genuinely meets your obligations before you send it anywhere.
Reuse rights
Scrubbed content is yours to reuse without asking, because the vendor never receives it and claims no licence over it. Output can be downloaded as a sanitised file keeping its original format, or copied straight to the clipboard, and the reveal step reconstructs the original text locally. The licence granted runs the other way: it is a revocable, non-exclusive right to use the software, personal use on the free tier and commercial use on PRO, TEAMS and ENTERPRISE. Reverse engineering is prohibited, and reselling TEAMS or ENTERPRISE session-handoff links outside your organisation is not permitted. Site data is a separate matter: form submissions pass through Web3Forms and traffic is measured by Vercel Analytics.
Data retention & training
Hosting summary
There is effectively no data hosting to describe, and that is the point. Scrubbing runs in your browser's memory, so the content you process is never stored on the vendor's infrastructure and no hosting country or region applies to it. The privacy policy states that a breach of the domain would expose only static hosting assets, never user input, and the technical security page describes a zero-data-at-rest policy. The session map is deliberately kept out of localStorage and IndexedDB. What is hosted is the site itself: the domain resolves to an address in the United States on Amazon infrastructure, and Vercel Analytics is named in the privacy policy as the aggregate traffic measurement. Web3Forms handles marketing form submissions, and payments run through Paddle and PayPal. Those are the only paths by which anything you type reaches a third party, and none of them touches the scrubbing engine.
Things to keep in mind
Risks and trade-offs to weigh before adopting PrivacyScrubber.
- Masking can breed false confidence: the vendor says plainly that verifying the output is your job, not the tool's
- There is no identifiable legal entity, address or jurisdiction behind the product, and no recourse if something goes wrong
- No Article 27 representative and no privacy contact, which European buyers will need to reconcile with their own obligations
- The session map dies with the tab, so an accidental reload can permanently strip your ability to unmask a long piece of work
- Other browser extensions can read the page, a limitation the terms acknowledge and the tool cannot fix
- Detection tuned for English will let unusual or non-Latin names through unless you write custom rules
- Compliance frameworks are named so prominently that a reader may mistake them for certifications the vendor holds
Setup & Integrations
Technical difficulty
Trivial for the main use. The web workspace needs no account, no installation and no configuration — open it, choose a profile and paste. The Chrome extension is a one-click install from the store. Two surfaces are developer-level: the MCP server needs a small block added to your IDE configuration, and the SDK is an npm install with no API key. Team rollout is deliberately light, using a single encrypted Blueprint link rather than a proxy or server, while enterprise fleets are pushed through Intune, Jamf or Google Workspace Admin.
Deployment
Integrations
Supported languages
Behind PrivacyScrubber
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement PrivacyScrubber.
Frequently asked questions
Does any of my data leave my device?
Which AI tools does it work with?
Can I get my original data back after the model replies?
What happens to the session map when I close the tab?
Is the free plan enough for regular use?
Does this satisfy HIPAA, GDPR or SOC 2?
Do I need a DPA or a BAA with the vendor?
Can I use it inside my IDE?
Does local processing slow my machine down?
Why did the engine miss a particular name?
Should you pick PrivacyScrubber?
PrivacyScrubber answers a problem most security teams recognise: staff paste confidential material into public chatbots whatever the policy says, and network controls never see it happen. Its response is unusually literal. There is no server to trust, so the promise can be tested rather than believed — disconnect the machine, scrub a document, and watch it work anyway.
That verifiability has commercial consequences. With nothing reaching the vendor, procurement loses its usual friction: no processing agreement to negotiate, no business associate agreement, no vendor risk review. For a legal or clinical team that has waited months for permission to use AI at all, that may settle the question by itself.
The functional spread is wide for something this new. Four surfaces run the same engine, more than twenty industry profiles catch entities a generic detector would miss, and office formats including scanned PDFs are handled offline.
The reservations concern the company rather than the software. No legal entity, postal address or governing jurisdiction appears anywhere on the site; no Article 27 representative is named for a product sold explicitly to European teams; the only published contact is a support mailbox. The compliance frameworks on display are targets the tool helps you reach, not certifications it holds. Testimonials are declared composite, and the structured data carries an aggregate rating no visitor can check. The domain was registered in February 2026, which sits awkwardly beside a 2024 copyright line.
None of this is disqualifying for a tool that never receives your data, since the architecture makes the usual vendor questions largely moot. But anyone rolling it out across a fleet should run the airplane-mode test personally, confirm the profiles catch what their sector actually cares about, and treat the compliance claims as a starting point rather than an assurance.
- Choosing a selection results in a full page refresh.
- Opens in a new window.