Clotr

Clotr is a free, open-source browser extension that watches the message box on AI chat sites and warns you before a password, key or personal detail is sent. It checks on your device with readable pattern matching, with no AI inside, no server and no account. It runs on Chrome, Brave, Edge and Firefox on a computer, and the latest listed release is v1.3.0.

What It Is

Clotr is a data-loss-prevention and privacy tool for people who use AI chat services. It watches the text you type and the files you attach on 19 AI chat sites, with ChatGPT, Claude and Gemini among them. When it finds something sensitive, a warning appears in the corner and you choose whether to cover the detail or send it anyway. Email and chat sites such as Gmail and Discord stay off until you turn them on.

What It Detects

The patterns cover API keys, tokens, webhook links, connection strings and seed phrases. They also cover card numbers, Social Security and ITIN numbers, bank accounts, IBANs and medical record numbers, plus phone numbers and addresses, including details that are spelled out or misspelled. It reads text in attached text, PDF, Word, Excel and PowerPoint files, and it warns when a photo carries embedded location data. You can add your own names and details, which are stored only as a scrambled code. Clotr cannot read words inside images.

Scam Protection Features

When a message asks for something scammers go after, such as a sign-in code or a card security code, the warning explains who would really be asking. An "Is this a scam?" page marks known warning signs in pasted messages and never calls a message safe. Clotr also warns about copied "verify you're human, paste this" commands. Tourniquet applies stronger settings in one step, Bandage swaps details for cover names such as [Phone 1], and Practice offers made-up scam and AI chat messages to learn from.

Privacy and Verifiability

The project states that Clotr contains no network code and that a test fails the build if any is added. The patterns are in a readable file, and releases are reproducible: building a release tag yourself should match the published SHA256SUMS.txt. Clotr stores only a short local record of the kind of detail found, the site and the time, visible only in its own Settings.

Team Rollout

An administrator can set policy through supported browser management, using presets for developer credentials, client/matter details, clinics and tax offices, or custom formats. Clotr reports no prompts or findings to the organization and has no admin dashboard. Custom values are not encrypted from policy administrators.

Licensing

Clotr is released under AGPL-3.0-or-later, and a commercial license is available by email for closed-source use.