Pace Prepped Prompts

Don't trust us. Verify it.

Every prompt tool claims to be "privacy-first". Here's how you check whether that's true — for us and for everyone else.

1. The permissions don't lie

An extension can only do what its manifest declares. PPP requests:

• storage — to save your prompts locally in your browser
• clipboardWrite — to copy a prompt when you click it
• downloads — to export and sync your library as a file for backup or sharing
• contextMenus — the "Pace Prepped Prompts" entry when you right-click selected text
• activeTab + scripting — to read the text you selected, only when you use that menu entry or the Workbench shortcut, and only in that tab
• sidePanel (Chrome, Edge) — to show the Workbench next to the page

No host permissions at install, and no content scripts: PPP runs on no website by itself. It touches a page in exactly two moments, both started by you and both in front of you:

• You right-click selected text (or press the Workbench shortcut): PPP reads that selection in that tab — nothing else. You see it land in the Workbench, or in your chat when a quick prompt sends it straight there.
• You press Send to LLM: PPP opens your chat page in a new tab, types the prompt in and, if you left that on, presses Send. You watch every step.

The one access you grant on top is for Send to LLM: when you add a chat page under Settings → Send to LLM, your browser asks you to allow PPP on exactly that site. Remove the chat page, and PPP gives the access back. That is why the manifest lists https://*/* as optional — you pick the site, nothing is granted until you do.

In Firefox, that same dialog has one more line. The Firefox build declares no required data collection and one optional category, websiteContent: the text you select, which Send to LLM types — inside your prompt — into the chat page you added, and nowhere else. Firefox does not ask for it at install; it asks when you add a chat page, and PPP gives it back when you remove the last one. Nothing is sent to us.

Verify it yourself: open chrome://extensions, enable Developer mode, click "Details" on PPP → "Permissions"; in Firefox, open about:addons → PPP → "Permissions and data". Or inspect the manifest.json inside the extension package. PPP's own code is plain, unminified JavaScript — open background/selection.js and background/send.js in the package and read exactly what it does.

Compare that to what other prompt tools request at install: access to specific AI sites at minimum — some request access to all websites.

2. No server, nothing to leak

PPP's own code makes no network requests. There is no PPP cloud, no account, no analytics, no telemetry. Your prompts stay on your machine until you send one with Send to LLM. Send to LLM opens your chat page like a link; that site then loads as usual, and your prompt goes exactly where a pasted prompt would go — to your chat's provider, in a tab you are looking at.

Verify it yourself: open DevTools (F12) → Network tab, use PPP. You will see no outgoing traffic from the extension.

3. Even the license check is offline

Your license key is verified locally using an ECDSA P-256 signature. No activation server, no phone-home, works air-gapped.

And yes — a check that never phones home is a check you could crack. I know . Trust goes both ways.

4. Your data is portable

Export your entire library as JSON at any time. No lock-in.

5. Report a vulnerability

Found a security problem in PPP? Email info@aim-to-pace.ai — please include the PPP version, your browser and its version, and the steps to reproduce it. We acknowledge reports, fix confirmed security issues, and ship security updates for at least five years: for Pro licenses from the purchase date, for the free version from the release of the installed version. Coordinated disclosure is welcome — give us time to ship a fix before you publish. Machine-readable contact: security.txt.

Why can we promise this and others can't? Because any tool with a built-in AI enhancer must send your prompt to a server to improve it. PPP prepares prompts with any method — preferably, of course, with AIM-TO . You decide. No API call. That's a design decision, not a marketing claim.

Chrome, Edge and Firefox are trademarks of their respective owners. PPP is independent and not affiliated with, endorsed or sponsored by them.