Browser extension support
Public support reference for the NeutralAI browser extension
This is the canonical support page for browser store review, self-serve installs, and enterprise rollout conversations. It explains the extension’s limited purpose, requested permissions, and the NeutralAI-owned app and API surfaces it interacts with.
Data handling & trust
What this extension does not do
In December 2025 several “privacy” browser extensions were found harvesting millions of users’ AI chats. Because this extension attaches to the same AI chat pages, we state its data handling plainly and keep it auditable — so users, IT administrators and store reviewers can verify we are not doing that.
No conversation collection
We never sell, share, or retain your conversations, and we run no analytics or model training on them. Prompt text is used only to detect and mask PII — in local mode without leaving your browser, in managed mode via the gateway masking call described below — then discarded.
No browsing-history harvesting
Content scripts run only on the supported AI chat sites listed in the manifest — nowhere else. The extension does not read, collect, or transmit the content of your other tabs or general browsing.
No ads, trackers or affiliate links
The extension injects nothing into pages beyond the masking behaviour, and monetises none of your activity.
No remotely hosted code
All executable logic ships inside the reviewed extension package. Nothing is fetched and run from a remote server at runtime.
Local mode (default)
Detection and masking run entirely in your browser — your prompt text is never sent to NeutralAI servers. The extension still makes background calls for policy/config refresh and metadata telemetry, which never carry prompt content.
Managed mode (signed in)
Prompt text is sent over TLS to the NeutralAI gateway for stronger server-side detection and the masked result is returned. Reversible mask tokens live in an encrypted vault (AES-256-GCM) with a short TTL (15 minutes by default), then are destroyed. The audit log records the entities masked, not your full prompt text.
This page is the public statement of that posture; the same attestation ships inside the extension package as SECURITY.md for installed users and store reviewers. Vulnerabilities can be reported via /.well-known/security.txt.
Requested permissions
storage
Used to store extension settings, managed policy values, cached auth state, and a bounded retry buffer for telemetry delivery.
activeTab
Used to scope extension interaction to the active supported AI tab when the user opens the popup, instead of requesting broad access to all browsing activity.
scripting
Used to run the extension’s packaged content-script logic on supported AI web apps so sensitive prompt content can be detected and masked before submission.
alarms
Used to schedule lightweight background tasks such as remote configuration refresh and telemetry retry or flush without constant background polling.
tabs
Used to open the NeutralAI sign-in page when an unmanaged user chooses to authenticate from the extension popup.
Review notes
Host permissions are limited to supported AI web applications where prompt masking runs, plus NeutralAI-owned app and API domains used for session detection, auth context, masking, remote configuration, and telemetry.
The extension does not use remotely hosted executable code. All executable logic is packaged in the extension bundle. Network requests are only made to NeutralAI APIs for session detection, auth context, masking, remote configuration, and telemetry.
Self-serve users authenticate through the NeutralAI app sign-in path, while enterprise customers can deploy managed policies and force-install the extension through browser management tooling.
Self-serve auth flow
Public app and API endpoints
- https://app.neutralai.co.uk/auth/signin
- https://app.neutralai.co.uk/api/auth/session
- https://app.neutralai.co.uk/api/extension/auth-context
- https://api.neutralai.co.uk/v1/shield/mask
- https://api.neutralai.co.uk/api/v1/extension/config
- https://api.neutralai.co.uk/api/v1/extension/telemetry
Enterprise rollout
Policy-managed deployment
Enterprise customers can deploy the NeutralAI browser extension with managed browser policies so the extension is force-installed, pinned, and locked to organization-controlled NeutralAI endpoints.
That rollout path is separate from self-serve sign-in and is the recommended approach for regulated teams or centrally managed browser fleets.