/ 01Introduction & short version
This Privacy Policy explains how Zabcore Inc. ("Zabcore", "we", "us") collects, uses, and protects information when you visit zabcore.com or use our product, AI Leak Guard.
/ 02The extension & your data
AI Leak Guard is a browser extension that scans text you paste and files you attach on supported AI-tool pages for sensitive identifiers, and (as of v1.3) also reads the message you are about to send on ChatGPT, Claude, and Gemini so it can check it on your device before it goes. All of that happens locally on your device. You decide whether to send the original, a masked version, or nothing.
What the extension does not do
- Does not send the text you type, the message you are about to send, or the text it detects, to any server owned by Zabcore or anyone else.
- Does not create or maintain any account, profile, or identifier for you.
- Does not include analytics, telemetry, tracking pixels, or any third-party SDKs.
- Does not read text on pages you don't interact with; the extension activates only on paste, file attach, or send events on the supported AI-tool pages.
What the extension does over the network
AI Leak Guard makes no outbound network requests. Detection patterns are bundled with the extension and update only when the extension itself updates through the Chrome Web Store. There is no telemetry and no runtime fetching.
Send-time processing (v1.3)
When you send a message on a supported site, the extension reads the message you are about to send so it can check it on your device before it goes. That text is never uploaded or stored. This is the same local-only processing already used for pasted text and attached files. Send-time protection runs on ChatGPT, Claude, and Gemini today; other supported sites still get paste checking and document scanning as before.
Verify it yourself
The full source code is published at github.com/zabcore/ai-leak-guard under the MIT License. Anyone can audit exactly what the extension does.
/ 03The zabcore.com website
When you visit zabcore.com we collect a small amount of information about the visit itself.
- Server logs from Cloudflare. Standard access logs (timestamp, IP address, user agent, requested URL, HTTP status). Retained by Cloudflare per their retention practices and used for security and abuse prevention.
- Cloudflare Web Analytics. A privacy-first analytics product that shows us aggregate page views, top pages, and rough country-level geography - without cookies and without tracking individual visitors across sessions or sites. We do not use Google Analytics, Meta Pixel, LinkedIn Insight, or any other cross-site tracking.
We do not use cookies for advertising or profiling. The site does not sell any information about you.
/ 04Contact emails & support
If you email us (through the contact form or directly at hello@zabcore.com, support@zabcore.com, or legal@zabcore.com), we retain the message and any information you include in it - typically your name, email address, and the substance of your question or request - for as long as needed to respond and maintain a record of the correspondence.
If you request early access to a future clinics/teams offering, we may keep your name, email address, and practice details (if you provide them) in a waitlist. You can ask us to delete this information at any time.
/ 05How we use information
We use the limited information we do collect only to:
- Operate the zabcore.com website and keep it fast and secure.
- Respond to messages you send us.
- Understand aggregate traffic to improve the site (via Cloudflare Web Analytics - not personally identifiable).
- Notify people on the clinics waitlist when the offering is available.
We do not use anything you send us for advertising, do not sell it, do not share it with data brokers, and do not use it to train AI models.
/ 07Retention
The extension
The extension stores detection settings and user preferences locally on your device (in Chrome extension storage). We do not retain any of that data on our servers because we do not have access to it.
Website analytics
Cloudflare Web Analytics data is retained per Cloudflare's standard practices (typically 6 months) and is aggregate, not personally identifiable.
Contact emails
Support and general email is retained for up to 3 years for record-keeping, unless you ask us to delete it sooner.
Clinics waitlist
Kept until the clinics offering launches and we've had a chance to reach out, or until you ask us to remove you.
/ 07aHIPAA framing
AI Leak Guard is described on this site as a technical safeguard that helps reduce the risk of impermissible PHI disclosure to third-party AI tools. That framing is deliberate. AI Leak Guard supports your organization's HIPAA compliance efforts. It does not, by itself, make any organization HIPAA compliant; compliance remains your organization's responsibility.
Because the extension never transmits the content it scans, and Zabcore never receives PHI, we are not a "business associate" for the purpose of your practice's use of AI Leak Guard, and no Business Associate Agreement is required or offered. Your practice remains responsible for its own risk analysis, workforce training, and administrative safeguards.
/ 08Your rights
You have the right to know what information we have about you, to correct it, to delete it, and to opt out of processing where applicable. To exercise any of these rights, email privacy@zabcore.com. We will respond within 30 days (45 days if the request is complex, with notice to you). We will not discriminate against you for exercising any of these rights.
/ 09US state-specific rights
If you are a resident of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Virginia (VCDPA), Texas (TDPSA), Oregon (OCPA), or another state with comparable privacy law, you have specific rights under that state's law including access, correction, deletion, portability, and opt-out of "sale" or "sharing" of personal information.
We do not sell or share personal information in the sense used by any of these laws. We collect only what is described in this policy and use it only for the purposes described. To exercise your state-specific rights, email privacy@zabcore.com.
/ 10International users (GDPR baseline)
AI Leak Guard is currently offered primarily to US-based healthcare workers, but the extension is available globally and the zabcore.com website is reachable from anywhere. If you access our services from the EU, UK, or another jurisdiction with data protection laws:
- Legal basis: We rely on legitimate interest (operating the site and responding to contact) and consent (for the clinics waitlist).
- Data transfers: Zabcore is a US company. Any information you send us is processed in the United States. For EEA/UK users, we rely on the appropriate transfer mechanisms available under GDPR/UK GDPR.
- Your GDPR rights (access, rectification, erasure, restriction, portability, objection) are covered by our Section 8 process above.
/ 11Data security
The single most important security fact about AI Leak Guard is architectural: we don't have your data. There is no server-side database of patient content to breach, subpoena, or leak. See /security for the full picture.
For the website and any correspondence, we use industry-standard technical and organizational measures - HTTPS everywhere, principle of least privilege, and a small team that treats data quietly. No system is perfectly secure; we're honest about that.
/ 12Children's privacy
AI Leak Guard is intended for adult healthcare workers. We do not knowingly collect personal information from anyone under 16. If you believe we have received information from a child, please email privacy@zabcore.com and we will investigate and delete it.
/ 13Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes we will update the "Last updated" date at the top of this page. We will not weaken your privacy without giving you clear notice.
/ 14Contact
Privacy questions: privacy@zabcore.com
General contact: /contact · hello@zabcore.com
Mailing address available on request.