Privacy before the provider

Visitors paste things into a chat box: an email address, a phone number, sometimes a key or token. Without a guard, that text goes to an AI provider and into the question history.

The Worker removes personal data before anything leaves it: email addresses, long digit groups that look like phone, card, account or national-id numbers, IBANs, and secrets such as provider keys, cloud access keys and tokens. Each is replaced with a placeholder ([email], [number], [secret]), so the model still reads a sentence and is told never to ask for or repeat them. The same cleaned text is what gets stored, and the widget tells visitors that questions go to AI providers and are kept for 90 days.

Redacted personal data such as emails and phone numbers from every visitor message before it reaches an AI provider or the question history, and told visitors in the widget how long questions are kept. Privacy is enforced in the request path instead of promised in a policy.

• Pattern matching cannot find everything. Names and street addresses are not caught, and an unusual number format can slip through.
• It can over-redact: a plain run of years is exempted for that reason, but a long non-personal number would still be masked.
• A placeholder makes a question slightly less clear to the model.

Emails, phone-style numbers and keys never reach a provider or the history, and privacy is enforced in the request path instead of being a promise in a policy.