Privacy Policy

VeilGuard browser extension, Windows desktop app & VeilGuard Keyboard for Android · Last updated 18 October 2026

In short: VeilGuard is 100% offline by default. It inspects what you're about to send on your own device, and nothing leaves without your approval or redaction. It doesn't collect, store off-device, or transmit your prompts, pastes, files or browsing activity.

What VeilGuard processes

To protect you, VeilGuard reads text you type or paste, files you attach, and the pages and links you visit in protected browser tabs and supported desktop apps. All of this analysis runs locally in the extension or desktop app. That includes detection of personal data, API keys, passwords, crypto keys and seed phrases, web threats, the optional industry protection packs (finance, healthcare, legal and Web3), and sign-in and MFA phishing checks.

What we collect

Nothing, unless your organisation links your device to a team plan (see below). VeilGuard has no personal accounts, no analytics, no telemetry and no remote logging. SecureIT (published and owned by Eight Galaxies LLC) does not receive any of your data.

What stays on your device

• Your settings and the list of sites you choose to protect.
• Scan history and counts, so you can review what was caught.
• The tamper-evident evidence log (a SHA-256 hash chain) and the operational log.
• Threat visibility data, plus any CSV, JSON, evidence-pack or HTML/PDF report exports. These are generated locally and saved only where you choose.
• For the password-reuse alarm, a salted hash of the passwords you use on your real sign-in domains. The passwords themselves are never stored.
• Downloaded blocklists used for local matching, if you've turned that lookup on.
• For Family protection, the age band, a salted PBKDF2 hash of the parent PIN (never the PIN) and, for each block, only the topic and the time. The text of the prompt or search is checked on the device and never stored or sent.

Uninstalling the extension or app removes this data.

Optional network lookups

Four protections can use a small amount of information from the internet. All four are off by default. Each one needs your explicit approval before it runs, and the approval prompt shows exactly what would be sent. You can switch any of them off again in settings. None of them sends the content you type, paste or attach.

• Password breach check — uses k-anonymity: only the first few characters of a hash of the password are sent; the password itself never leaves your device.
• Domain age (WHOIS/RDAP) — sends the domain name being checked.
• DNS verification (DNS-over-HTTPS) — sends the domain name being resolved.
• Community blocklist download — downloads lists of known-bad domains; matching happens locally.

These requests go directly from your device to the respective public service and are subject to that service's own privacy practices.

Enhanced AI detection (optional, on your device)

The extension, the Windows app and VeilGuard Keyboard can use an optional AI model to also find names, street addresses, organisation and project names and health details. It is off by default. When you turn it on, VeilGuard asks first and tells you the download size and where it comes from. The model (about 14 MB) is then downloaded once from our public download server (github.com/ultrakingdoms2025/veilguard-releases, or a server your organisation chooses). The download sends no information about you, no identifier and none of your text. VeilGuard checks the file against a fingerprint (SHA-256) built into the app before using it, keeps it on your device, and records the download in its local log.

The analysis runs entirely on your device: the text you send, paste or upload is checked by the model inside the extension, the Windows app or the keyboard, and is never sent anywhere. Findings are handled like every other finding (masked previews and counts only). Your organisation can turn this feature off, leave it to you, or turn it on (the model is then downloaded automatically). You can remove the model at any time in settings.

VeilGuard Keyboard (Android)

VeilGuard Keyboard is an Android keyboard. Like every keyboard, it can see what you type in apps where you choose it. It uses that to show suggestions and to check, on your phone, whether a message contains sensitive data before you send it. Typing, suggestions and VeilGuard checks never use the internet.

• Stored on your phone only: your settings, a personal dictionary of words you accept, clipboard history (expires after one hour by default, and items VeilGuard marks as sensitive are never kept), and a history of what was caught that shows masked previews only, never the full values.
• Password fields: nothing typed into password fields is learned, suggested or saved, and online features are never offered there.
• Voice typing: uses the speech-recognition service already on your phone, preferring offline recognition. If that service needs the internet, the audio is handled by its provider (for example Google) under its own privacy terms, not by us. The microphone is used only while you use the mic key.
• Scan text: camera text recognition runs on your phone. Photos are not saved or sent.
• Images in the clipboard: when you copy an image or screenshot, the keyboard makes a smaller copy without its hidden details (such as location and camera), reads the text in it on your phone to check it before you paste, and keeps it in the encrypted clipboard history with the same expiry as text. Images copied in password fields or while typing incognito are not kept, and images with sensitive data found in them stay in memory only and are never saved. "Suggest recent screenshots" is off by default and uses no photo permission: you pick the picture in Android's own photo picker, and only that picture is read.
• Clipboard sync with your PC (optional, off by default): after you pair the keyboard with the VeilGuard Windows app by scanning a QR code, text you copy goes directly between your phone and your PC over your local network, encrypted end to end. It never goes through our servers or anyone else's. Items from password fields are never sent, and items VeilGuard finds sensitive are held until you choose to send them. Unpair on either side to stop it.
• Backups: keyboard data is excluded from Android cloud backup and device transfer.

Online features (you can turn each one off)

Three optional features use the internet, and only when you tap them. Settings has a switch for each and one switch that turns all of them off. Before any text leaves your phone, VeilGuard checks it and masks anything sensitive.

• Translate: language packs are downloaded from Google the first time you use a language. The translation itself runs on your phone; your text is not sent.
• GIFs: your search words (after the VeilGuard check) are sent to GIPHY to find GIFs, and GIF images are loaded from GIPHY. GIPHY's own privacy policy applies.
• AI rewrite: on phones with Google's on-device AI, the rewrite happens on your phone. Otherwise, if you allow cloud AI, the text you asked to rewrite is sent, already masked by VeilGuard, to our rewrite service at veilguard.site, which passes it to an AI model through Vercel's AI Gateway and returns the result. We do not store or log the text or the result. A random install ID and a one-way hash of your IP address are kept for one day only, to limit how often the service can be used.

Organisations that manage phones can turn the online features off through Android's managed configuration. If you or your company link the keyboard to a company ID, it works like the browser extension and Windows app (see Team plans below): it downloads the company's settings and sends a random device ID, a label such as "Android · phone model", the app version and daily counts only, never what you type. AI rewrite requests from a linked phone also carry the company and device IDs so the company's higher limit applies. Uninstalling the keyboard deletes all of its data.

VeilGuard for Outlook and the VeilGuard check app for Teams

The Outlook add-in checks the email or meeting invite you are writing when you press Send, and when you open its pane. The check runs inside Outlook on your device, using the add-in's files loaded from veilguard.site; the subject, message, recipients and attachments it reads are never sent to us or to anyone else. Microsoft serves Office.js, the library every Outlook add-in uses.

• What it reads: the subject, message text, recipient addresses (only to tell internal from external domains) and attachments (text files at send time; Office and PDF files when you open the pane; other files by name only) of the item you are sending.
• What it stores: its settings, values you mark "Not sensitive", and pending daily counts, in the add-in settings of your own mailbox (Office "roaming settings"), so they follow you between Outlook apps. Masking changes only the message you are writing.
• Alerts: the send alert names the kind of data and how many items were found, never the data itself.
• Company link: only if you or your admin link the add-in to a company ID, it works like the browser extension (see Team plans below): it downloads the company's settings and sends a random ID kept in your mailbox's add-in settings, the label "Outlook on the web", "Outlook for Windows" or "Outlook for Mac", the add-in version and daily counts per detector, category, severity and action. Never message text, addresses, values or file names.
• Teams: the VeilGuard check app is a page that checks text you paste into it, on the page. Nothing you paste is sent anywhere.
• Windows app helper: if you choose "Install for classic Outlook" in the VeilGuard Windows app, it downloads the add-in manifest from veilguard.site (that request is in the app's operations log) and writes one registry value for Outlook. Remove deletes it again.

Regulated environments

The industry protection packs and the local evidence log are designed to help support data-protection and privacy programs, for example in finance, healthcare and legal teams. VeilGuard does not by itself make an organisation compliant with any law, regulation or standard, and it is not certified against one.

Admin-managed installations

If your organisation manages the Windows app through registry policy or ADMX templates, an administrator may configure behaviour such as forced redaction. These policies are applied locally; VeilGuard does not send your data to your administrator or to SecureIT.

Team plans (company-linked devices)

If you or your company admin enter a company ID in VeilGuard, the extension or app downloads that company's settings from veilguard.site and applies them. To show the company which devices are protected and what was caught, a linked device sends: a random device ID created by VeilGuard, a device label (for the Windows app, the computer and Windows user name; for the extension, the browser and operating system; for the Android keyboard, the phone model), the VeilGuard version, and daily counts per detector, category, severity, action and site or app name. It also sends a short record when something sensitive is sent anyway after a warning, blocked, or masked because the company requires it (the time to the minute, the site or app, what kind of data was found, the risk level and the action), plus a reason in your own words if your company asks for one when you choose "Send anyway" (up to 200 characters, checked by VeilGuard first; on the keyboard you pick from a short list). It also counts, per day, how often AI tools such as ChatGPT or Claude are opened and how many prompts are sent, never the prompts. It never sends the text you typed, pasted or uploaded, the values that were found, file names or full web addresses. Company admins can turn count sharing off. Event records are deleted after the period your company sets (180 days by default). These details are stored for the company that owns the subscription and are deleted when the company is removed. Unlinking a device stops all of this.

Permissions

VeilGuard Keyboard requests vibration (key feedback), internet access (only for the optional online features above) and, only if you use those features, the microphone (voice typing), the camera (scan text and the clipboard-sync pairing code), local network access and notifications (clipboard sync with your PC). The browser extension requests permission to read and modify pages so it can inspect composers, links and page behaviour, and to access the clipboard so it can guard against pastejacking. These permissions are used only for local protection.

Changes & contact

If this policy changes, the updated version will be published on this page and in the GitHub repository. Questions or concerns? Open an issue. See also our terms of use.