Your data stays on your device.

DraftGuard is a Chrome extension that auto-saves what you type into web forms, helps you recover lost form data, and lets you reuse your saved answers on similar forms. This policy explains, in plain language, exactly what data DraftGuard handles and how.

What DraftGuard stores

So your work survives a crash, an accidental close, or a session timeout, DraftGuard keeps a private local backup of the form content on your own device — the same idea as autosave in a document editor. This backup never leaves your computer, is never sent to us, and no one but you can ever see it (DraftGuard has no server that receives it and cannot read it). Each saved version includes:

• A local copy of the form content, kept on your device so you can restore it later.
• Descriptive metadata about each field (its label, name, id, placeholder, field type, and section/legend if any). This helps match similar forms across different sites.
• The page title and URL of the form.
• A timestamp.

Templates you choose to create from the popup and any settings you change are also stored locally. All of this lives exclusively in your browser's IndexedDB on your own device — DraftGuard keeps no server-side copy and cannot read any of it.

What DraftGuard does NOT store

DraftGuard automatically detects and skips:

• Password fields (<input type="password">).
• Credit card numbers, CVV codes, expiration dates, and any field that looks like a payment field by name, label, autocomplete attribute, or surrounding container context.
• Hidden form fields (<input type="hidden">).
• File upload fields (<input type="file">).

These rules are hardcoded at the field-detection layer. They cannot be disabled, even in Settings.

Where your data lives

• Every snapshot, template, and setting is stored locally on your device in your browser's IndexedDB.
• All of your DraftGuard data is encrypted at rest using AES-256-GCM, with a key generated and kept only in your own browser. Even the local on-disk copy is unreadable without that key.
• DraftGuard does not operate any backend servers.
• DraftGuard does not have a database that contains your data.
• DraftGuard does not have any account system, user identifiers, or login.
• The developer has no technical mechanism to access your data. Your data exists only on the device(s) where you have DraftGuard installed.

Encryption at rest

Everything DraftGuard stores on your device — your recovery drafts, saved answers, profile/identity, and voice & fact data — is encrypted at rest with AES-256-GCM before it is written to storage. The encryption key is created in, and never leaves, your own browser — DraftGuard has no server, no account, and no copy of it, so no one (including the developer) can decrypt it. This is in addition to the fact that your data never leaves your device in the first place.

What DraftGuard sends to remote servers

Nothing about you, and nothing you type. Your snapshots, saved answers, drafts, profile, and voice profile never leave your device. The one exception is the optional AI features you turn on yourself (see "Optional AI features" below).

DraftGuard does send anonymous, aggregate product-usage events, described in "Anonymous product analytics" directly below. Apart from that, it makes no requests for error reporting on your content, remote script loading, or remote update checks against a server; all code and assets are bundled with the extension itself.

Anonymous product analytics

To understand whether people who install DraftGuard actually get value from it, and to fix the product when they don't, DraftGuard records a small, fixed set of anonymous, aggregate usage events. These are first-party only (sent to our own endpoint, with no third-party trackers or SDKs) and are stored only as running counts.

What is recorded: the name of an event from a fixed allowlist, plus the extension version. For example: extension installed, onboarding completed, a draft was started / accepted / cancelled, a saved answer was created, settings opened, "Get Pro" clicked, a license activated. Nothing else.

What is never recorded: your typed text, saved answers, draft text, voice-profile text, field values, page text or URLs, passwords, payment data, SSNs, one-time codes, your name or email, or any device or personal identifier. The events carry no content and cannot be tied back to you or your device.

Because this analytics data contains no personal information and exists to keep the product working, it is always on and there is no separate on/off toggle for it. The optional AI features are entirely separate and remain off by default.

One incidental remote request exists: the Templates and Typing History tabs of the popup load small site icons (favicons) from Google's public favicon service (https://www.google.com/s2/favicons) so you can visually identify which site each saved draft came from. Only the domain name of the site you saved (which is already public information) is sent in those requests; none of your typed content is included. If you'd prefer no requests at all, you can blacklist google.com from Settings. The favicons will simply not load, and DraftGuard will continue to work normally.

Permissions DraftGuard requests, and why

• storage: to save your drafts, templates, settings, and dismissed prompts on your device.
• tabs: to identify which tab is currently active so the popup can show drafts that match your current page.
• activeTab: to read the values of form fields on the page you're currently using, so it can save and restore them.
• alarms: to schedule periodic local cleanup of drafts older than your data-retention setting (default: 30 days).
• <all_urls> host permission: so DraftGuard can offer to recover or reuse your work on any website you choose to use it on. You can blacklist any domain individually so it never runs there.

Sites where DraftGuard never runs

• Any domain you add to your blacklist in Settings.
• Any domain you silence via the "Don't show on this site" link in the recovery bar.
• Any URL whose path contains /checkout, /payment, or /billing.
• Any field detected as a password or payment field, on any site.

Your data, your control

You can, at any time:

• Export all your saved data as a JSON file (Settings → Privacy → Export).
• Import a previously exported JSON file.
• Delete a single draft, every draft from a specific domain, or all drafts you've ever saved.
• Add any domain to the blacklist so DraftGuard never runs on it.
• Disable DraftGuard entirely from the Settings page.

When you uninstall DraftGuard, Chrome removes the extension's local storage along with it. All saved drafts are deleted automatically, and there is nothing left for anyone (including the developer) to recover, because there were never any external copies.

Third parties

DraftGuard has no third-party SDKs, no third-party analytics, no advertising networks, and no third-party data processors. Its only outbound network calls are first-party: the anonymous product-analytics events and the optional AI proxy (both described above), plus Google's public favicon service. None of these carry your typed content, and the analytics carry no personal data at all.

Children

DraftGuard does not knowingly collect personal data from anyone, including children under 13. Because DraftGuard does not transmit data anywhere, there is no central system that could contain a child's data.

Optional AI features (the "Voice Engine")

DraftGuard includes optional AI features that adapt your saved answers, and draft new ones, into your own voice for application questions. They are off until you explicitly enable them on a consent screen, and they are the only part of DraftGuard that transmits content.

• What's sent, only when you act: during onboarding, the writing samples or interview answers you provide (including text extracted on your device from any résumé/file you upload); when you click "Adapt," the form's question, the saved answer being adapted, the detected length limit, and the page's company/site name; when you click "Draft from my voice," the form's question, your approved Voice/Fact Profile facts, and relevant on-page context: the page's title/URL, the form's other field labels, and the answers you've already typed into other non-secure fields on that form. Password, payment, CVV, SSN, OTP/2FA, hidden, and file fields are excluded and their values are never sent.
• Where it goes: DraftGuard's processing proxy, which forwards it to Anthropic (Claude) and returns the result.
• Not stored: the proxy does not log or persist your content; it's processed and discarded. Your Voice Profile lives only on your device.
• Your control: turn AI off anytime in Settings → AI & Voice, and clear your Voice Profile whenever you like. Passwords and payment fields are never eligible for AI.

Changes to this policy

If we ever change how DraftGuard handles data, this document will be updated and the "Last updated" date at the top will change. Material changes will be mentioned in the extension's release notes on the Chrome Web Store.

Contact

For privacy questions, email [email protected]. DraftGuard is a privacy-first project. If anything in this policy is unclear or you spot something concerning, please reach out.