From the extension: nothing. It makes no outbound network requests. The website collects only the contact information someone voluntarily submits on a form, and the two systems share no identifier.
What the extension does, all locally
Does, all on the device
Inspect supported text as you paste it
Extract supported documents (PDF, Word, Excel, PowerPoint, text) before upload
Read the outgoing message at the moment you send it on ChatGPT, Claude, and Gemini
Classify potential patient identifiers
Warn you with categories and counts, and keep your draft while you decide
Fail-open on send: if the check fails, the message still sends
Maintain a metadata-only activity history in browser storage
Export that history to CSV or JSON, saved locally
Does not send to Zabcore
Prompts
The message you are about to send
Clipboard contents
Document contents
Filenames
Detected values
Names, MRNs, dates of birth, insurance IDs, or any other identifier
Two systems, one identifier apart
Zabcore operates two independent systems:
The AI Leak Guard extension runs in the browser on the user's device. It makes no outbound requests. Zabcore has no visibility into what it detects.
The zabcore.com website hosts contact forms and a product-updates signup. If someone chooses to submit a form, the information they type is stored in Zabcore's email tool (Loops) and, for practice signups, an internal CRM. That is the entirety of what the website receives.
There is no shared identifier between the two systems. The extension does not know who submitted a form on the website, and the website does not know who is running the extension.
The exact data flow
Detection and document extraction run entirely on the device. Zabcore never receives patient content.
How you can verify this
The extension is open source under MIT. Anyone can audit the code, or open the DevTools Network tab while using the extension on any supported site and confirm that no requests are made by it.
The current privacy policy also states this in the same words. If a claim on this page contradicts the privacy policy, the privacy policy is the authoritative source and we consider the difference a bug worth reporting.
Bottom line
The extension does not phone home. The website only knows what you tell it. Nothing patient touches Zabcore infrastructure.