Talmur — Extension Privacy Policy

Last updated: 2026-05-13

This Privacy Policy describes how the Talmur browser extension ("Talmur", "we", "us") collects, uses, stores, and shares information when you use it, in accordance with the Chrome Web Store Developer Program Policies.

1. Who we are

Talmur is operated by Kretes Technologies. For any privacy-related inquiry, contact us at kretes.technologies@gmail.com.

2. Single purpose

Talmur detects personally identifiable and confidential information (PII) in user prompts and supported file uploads to ChatGPT, Claude, Gemini, Microsoft Copilot, Microsoft 365 Copilot, Perplexity, and NotebookLM, and replaces those values with reversible tokens locally in the browser, before any data leaves the user's device.

3. Data collection — what we collect and how

Talmur collects the following categories of data solely to perform its PII-masking function:

  • Prompt text: the text typed or pasted into the composer fields on chatgpt.com, chat.openai.com, gemini.google.com, claude.ai, copilot.microsoft.com, m365.cloud.microsoft, perplexity.ai, and notebooklm.google.com. This is read by a content script injected into those pages.
  • File contents: text extracted from .txt, .md, .csv, and text-layer .pdf files that you explicitly attach to a prompt on those sites. Files are read using the browser File Reader API inside an isolated offscreen document.
  • Entity-token map: the mapping between detected sensitive entities and their placeholder tokens, generated during masking and stored in browser session storage to allow the extension to re-hydrate model responses on the same page.
  • User preferences: settings you configure in the extension popup (e.g., which entity categories to detect, DLP toggle state), stored in chrome.storage.local.

All of the above is collected and processed exclusively on your local device. None of it is transmitted to Talmur servers.

4. How we use your data

The data described in Section 3 is used exclusively for the following purposes:

  • Running on-device ML inference to detect PII entities in prompt text and file contents.
  • Replacing detected PII values with reversible placeholder tokens before the prompt is submitted to the AI platform.
  • Restoring original values in model responses displayed in the browser, so you can read the un-masked output.
  • Persisting your extension preferences across browser sessions.

We do not use your data for advertising, profiling, or any purpose unrelated to PII masking.

5. Data storage

Data is stored as follows:

  • Session storage (chrome.storage.session): the entity-token map is stored only for the duration of the browser session and is automatically deleted when the browser is closed.
  • Local storage (chrome.storage.local): user preferences and the ML model weights cache are stored persistently on your device. You can clear this data by removing the extension from chrome://extensions.
  • Offscreen document memory: prompt text and file contents are held in-memory only during the analysis process and are not written to disk.

6. Data sharing — all parties

By default, Talmur shares no user data with any party. All processing is local to your device.

The only exception applies when your organization's IT administrator has configured a control plane URL via Chrome managed policy (chrome.storage.managed). In that case, Talmur may transmit the following to your organization's control plane server:

  • Authentication data:your work email address and hashed credentials, used to authenticate you with your organization's tenant.
  • Policy sync requests:requests to download entity catalogs and DLP rules from your organization's server.
  • Aggregate telemetry counters:numeric counts of detected entity categories per session (e.g., "5 EMAIL_ADDRESS, 2 IBAN"). No prompt content, no file content, and no actual PII values are ever included.

The control plane is hosted and operated by your organization, not by Talmur. We have no access to data stored on those servers.

Complete list of third parties that may receive data:

  • Your organization's control plane (only if an administrator has configured the extension via managed policy) — receives authentication data, policy requests, and aggregate telemetry counters only.
  • No other third party receives any data. Talmur does not integrate analytics SDKs, crash-reporting services, advertising networks, or any other external services.

7. Permissions and their purpose

  • storage / unlimitedStorage: store user preferences and ML model weights cache locally on your device.
  • offscreen: run ML inference in an isolated offscreen document, keeping analysis sandboxed from page content.
  • host_permissions on chatgpt.com, chat.openai.com, gemini.google.com, claude.ai, copilot.microsoft.com, m365.cloud.microsoft, perplexity.ai, notebooklm.google.com: inject content scripts to read prompt text and intercept file uploads solely for on-device PII detection.

8. Retention

Session data (entity-token map) is deleted automatically when the browser session ends. User preferences and model weight cache persist until the extension is uninstalled. If a control plane is configured, telemetry counters are retained on your organization's server according to your organization's own data retention policy.

9. Your rights

You can disable or uninstall Talmur at any time from chrome://extensions. Uninstalling the extension deletes all locally stored data. To toggle PII detection without uninstalling, use the DLP switch in the extension popup (unless your administrator has enforced "force DLP on"). To request deletion of data held on a configured control plane, contact your organization's administrator or reach us at kretes.technologies@gmail.com.

10. Changes to this policy

We will update this policy when material changes occur. The "Last updated" date at the top of this page always reflects the latest revision. Continued use of the extension after an update constitutes acceptance of the revised policy.

11. Contact

For privacy questions or data requests: kretes.technologies@gmail.com.