SARWriter Privacy Policy

Last updated: March 10, 2026

SARWriter is a Chrome browser extension that helps AML/BSA compliance analysts draft Suspicious Activity Report (SAR) narratives. This privacy policy describes how the extension handles your data.

Data Collection and Processing

What we collect

SARWriter processes text content from web pages you are viewing only when you explicitly click the "Extract" button. The extension does not run in the background, does not collect browsing history, and does not track your activity.

PII Anonymization (Client-Side)

Before any data leaves your browser, SARWriter's built-in anonymization engine detects and replaces Personally Identifiable Information (PII) with placeholder tokens. This includes:

• Names
• Social Security Numbers
• Account numbers
• Dates of birth
• Phone numbers
• Email addresses
• IP addresses
• Physical addresses
• Employer names
• Bank routing numbers

PII never leaves your browser. The anonymization happens entirely within the Chrome extension before any data is sent to our servers.

What is sent to our servers

Only anonymized case context (with PII replaced by placeholders like [NAME_1], [SSN_1], etc.) is sent to our backend API for AI narrative generation. This data is:

• Processed in real-time and not stored
• Sent over HTTPS (encrypted in transit)
• Used solely to generate a SAR narrative draft
• Discarded immediately after the response is returned

AI Processing

Anonymized text is processed by Google's Gemini AI to generate narrative drafts. The text is sent to Google's Gemini API under their standard API terms. No PII is included in these requests.

Data Storage

Local storage only

SARWriter uses Chrome's local storage (chrome.storage.local) to store:

• Your preferred settings (e.g., default SAR type)
• Temporary case data during an active session

This data stays on your device and is cleared when you click "Start Over" or close the browser.

No server-side storage

Our backend API does not store, log, or retain any case data, narratives, or user information. Processing is fully stateless.

Permissions

Why we need https://*/* (all HTTPS sites)

AML/BSA analysts use many different case management systems across institutions. SARWriter needs to read page content from whatever system you are using so it can extract case data. This permission is only exercised when you click the "Extract" button.

Other permissions

• sidePanel: Opens the SARWriter interface as a Chrome side panel
• activeTab: Reads the current tab's content when you click Extract
• storage: Saves your preferences locally

Third-Party Services

• Google Gemini API: Used for AI narrative generation (anonymized data only)
• Railway: Hosts our backend API server

Data Security

• All data in transit is encrypted via HTTPS/TLS
• PII anonymization runs locally before any network requests
• Backend API has rate limiting and input validation
• No user accounts, cookies, or tracking mechanisms

Children's Privacy

SARWriter is a professional compliance tool and is not directed at children under 13.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the "Last updated" date above.

Contact

For privacy questions or concerns, contact us at: sarwriter.privacy@gmail.com