Technical FAQ
For journalists, researchers, and anyone who wants the actual mechanics rather than the pitch. Every answer here is checkable against the shipped code (the extension is not open source, but specific claims below can be verified live, in the browser Network tab, or on request).
How does detection actually work?
Static phrase-matching by default. The extension ships with a maintained library of institutional euphemisms (bundled inside the extension package, not fetched from a server), each phrase linked to a specific legal citation. A content script scans visible page text and compose fields against that library and highlights matches. This runs entirely on-device; nothing is transmitted for the free tier.
What does the paid "AI-assisted detection" actually send, and where?
Only the text a user explicitly selects, capped at 3,000 characters — never a full page, never passively, only on an explicit action. It's sent to unmask.tools' own Supabase Edge Function, which forwards it to Anthropic's Claude API for analysis, then returns the result. Anthropic's standard 30-day data retention applies to that request (not zero-retention — we asked, and were told ZDR isn't available at our account tier; our privacy policy states this plainly).
Can I use it without sending anything to any company's servers at all?
Yes. The extension supports pointing AI-assisted detection at a locally-running Ollama instance instead of unmask.tools' API. In that configuration, nothing leaves the user's machine, including for the AI-assisted path.
What permissions does the extension request, and why?
activeTab (scan the page you're currently viewing, only on explicit invocation), storage (save settings, API key, and phrase libraries locally), clipboardRead/clipboardWrite (for scanning documents Chrome can't read from the DOM — Google Docs, PDFs — via explicit copy-and-scan, and for copying flagged phrases on click), host_permissions: <all_urls> (because institutional language shows up on domains that can't be enumerated in advance — internal company tools, any news site, any email provider). Full justification text, written against the actual code, is public in the Chrome Web Store listing's Privacy Practices section.
Can the phrase library be silently changed or expanded without users knowing?
No. It ships inside the reviewed, signed extension package. Updating it means shipping a new version through Chrome Web Store review, the same process any other update goes through — there's no server-side toggle that changes what gets flagged without a visible version bump.
What's the "bot template" / "give a chatbot a conscience" feature, mechanically?
A system prompt — nothing more exotic than that. Pre-built templates for Claude Projects, Gemini Gems, and Custom GPTs instruct the underlying model to apply the same plain-language, legally-anchored framework to its own responses. It's not a modification to model weights and it doesn't persist outside that conversation context — it's a well-designed prompt, publicly readable on the templates page, not a hidden mechanism.
Which platforms is this verified to work on?
Read and compose, tested: Gmail, Outlook (all variants), WhatsApp Web, Microsoft Teams, LinkedIn, Proton Mail, Telegram, Slack, Discord, Google Chat, Microsoft Copilot, Viva Engage, Microsoft Loop. Manual scan mode (select text, click extension, scan): Google Docs, Word Online, PowerPoint, PDFs — these render to canvas or cross-origin frames that a content script can't read live. Not supported: Google Meet chat (not in the DOM), Google Drive previews (canvas rendering).
Where does the open dataset come from, and what's actually in it?
Every phrase flagged, across all users, gets logged fully anonymized (no email, no API key, no identifying data) if the user has global data sharing enabled (opt-in, off by default). That feeds a public dataset — phrase, severity, sector, domain, country, confirmation count — browsable at unmask.tools' Report page, exportable via a public API for research/commercial licensing.
Is this open source?
Not currently. Happy to discuss what verification is possible short of that — code walkthroughs, specific claim verification — on request.
Questions not covered here: af@unmask.tools