Stop pasting client data into AI chats: a redaction step that runs entirely in your browser
Every day, developers and consultants paste real client data into AI chatbots. Names, emails, phone numbers, card numbers, amounts. The model gets a copy. So do its logs. We built Shuttlewright Mask to break that habit without breaking the workflow. It runs entirely in your browser tab: paste text
Every day, developers and consultants paste real client data into AI chatbots. Names, emails, phone numbers, card numbers, amounts. The model gets a copy. So do its logs.
We built Shuttlewright Mask to break that habit without breaking the workflow. It runs entirely in your browser tab: paste text in, sensitive values become tokens, send the masked text to any AI, paste the answer back, and the real values are restored.
Hi, my name is Kwame Mensah. Please remind our client Abena Osei ( abena.osei@example.com, 024 555 0134) that her invoice of GHS 4,250 is due Friday. Card on file: 4242 4242 4242 4242.
Masked: Hi, my name is [PERSON_1]. Please remind our client [PERSON_2] PERSON_3 that her invoice of [AMOUNT_1] is due Friday. Card on file: [CARD_1]. 7 sensitive values replaced.
The token map - which token means which real value - never leaves your browser tab. Only the masked text goes to the AI. Paste the reply back and Mask restores the real values, so your client-facing text reads normally.
Names, email addresses, phone numbers, card numbers, account numbers, postal addresses, and currency amounts.
Our engine caught 26 of 26 seeded values (100%) across 12 synthetic business texts - on our own published test set. Your text is not our test set. No detector catches everything, and masked text can still carry identifying meaning (a rare job title plus a city can identify a person). That is why Mask shows you the masked version before anything is sent: you are the last check.
Privacy tooling that oversells is just marketing. The self-test runs on the site, unedited, so you can check it yourself.
Free: the full mask-ask-restore loop in your browser, no account. Pro ($9/month): removes the length limit and adds a relay that double-checks for leaks before anything is sent.
Try it: https://shuttlewright-mask.pillar-3a8.workers.dev/
Feedback welcome in the comments, especially texts where it misses something. That is how the detector gets better.