Kamelo 开源 Chrome 扩展：在本地遮蔽个人数据后再发给 ChatGPT、Gemini、Claude

AI doesn't need to know everything.
A Chrome extension that masks personal data on your device before it reaches ChatGPT, Gemini, Claude or any other AI, and puts the real details back in the answer, only on your screen.

How it works

1. You type or paste a message into an AI chat, just like always.
2. Kamelo masks personal data on your device before anything is sent. Sarah Miller becomes [PERSON_1], an IBAN becomes [IBAN_1].
3. The AI answers with placeholders. Kamelo replaces them with the real values on your screen.

The link between placeholders and real values is kept in a local vault in your browser. There is no server, no account and no second AI: detection is rule-based (patterns, checksums and keyword lists), and restoring is a lookup in that vault.

You type:        Remind Sarah Miller to pay from GB82 WEST 1234 5698 7654 32.
The AI sees:     Remind [PERSON_1] to pay from [IBAN_1].
You see back:    Hi Sarah Miller, please transfer the amount from GB82 WEST 1234 5698 7654 32.

What it detects

Formats with a fixed structure (IBANs, cards, checksummed IDs, emails, phone numbers, keys) are recognised in any language. Keywords and month names are recognised in 20+ languages.

Sensitive topics

Health, mental health, sexuality, faith, money problems and police or courts can't be replaced by a placeholder. When you share something about yourself or someone close ("my doctor", "ik heb schulden"), Kamelo shows a short notice suggesting a temporary chat, once per topic per page. General questions don't trigger it. Recognised in 82 languages (word lists; corrections from native speakers welcome).

It remembers, carefully

Once Kamelo has masked a name, it also recognises it later in other forms: in lowercase, or just the first or last name, in the next message or chat, always with the same placeholder. To avoid false positives, single names only count when they look like a name (capitalised, or after cues like "to sarah" or "dear mark"), and names that are also ordinary words (Will, May, Mark) only after a clear cue. So "Will you help me?" and "mark this as done" stay untouched.

Anything masked from memory is listed in the notice. Click a word there to keep it visible: it goes on your "Never protect" list (with the site and date it came from), and you can undo it straight from the notice.

Where it works

• AI chats: ChatGPT, Gemini, Claude, Copilot, Perplexity, Mistral, DeepSeek, Grok, Meta AI and more (full list).
• AI fields on other sites: "Help me write" in Gmail, Slack AI, Notion AI and AI chat widgets, recognised by their labels.
• AI APIs called from the browser: requests to api.openai.com, api.anthropic.com, Azure OpenAI and others are masked before they leave.
• Any other site: "Mask every text field" in the popup masks every text field on that site.

Regular messages to people, such as a normal email or chat message, are left untouched.

Privacy and security

• No network requests. Kamelo never contacts a server, not even ours. There are no analytics, no tracking and no account. See Verify it yourself.

• Encrypted vault (optional). Lock the vault with Touch ID (WebAuthn PRF) or a password (PBKDF2, 600,000 rounds); the vault is encrypted with AES-256-GCM. When unlocked it lives only in memory (chrome.storage.session) and locks again when Chrome closes.

• Automatic cleanup. Vault entries that haven't been used for 30 days (adjustable) are deleted.

• Size limit. The vault keeps at most 10,000 entries (Chrome gives extensions 10 MB of storage); the least recently used entries go first.

Why each permission

See the privacy policy. To report a vulnerability, see SECURITY.md.

Verify it yourself

You don't have to take our word for any of this. Everything Kamelo does is in this repository, with no build step and no minified code.

• It makes no requests of its own. Search the extension code for network calls:

  grep -rnE "fetch\(|XMLHttpRequest|sendBeacon|WebSocket\(" src popup unlock

  The only hits are in src/net-main.js, where Kamelo wraps the page's own requests to AI APIs so it can mask them.
• The only pages it opens: kamelo.eu/welcome once after installing, kamelo.eu/goodbye when you remove it (both in src/background.js), and links you click in the popup. Opening a page sends nothing from your vault.
• Watch what is sent. Open DevTools (Network tab) on chatgpt.com, send My password is Hunter2! and look at the request payload: it says [SECRET_1].
• Run the tests. npm run test:browser loads Kamelo in a real Chrome and checks that requests to AI APIs leave with placeholders, not the real values (tests/browser/extension.test.mjs).
• The store package is this code. tools/pack.mjs zips manifest.json, _locales, src, popup, unlock and icons as they are. Download the package from the store, unzip it and compare it with this code at the same version (see manifest.json).

Screenshots

See kamelo.eu for screenshots and a short demo.

Installation

Chrome Web Store: coming soon. Microsoft Edge Add-ons: install Kamelo.

From source (developer mode):

1. Clone this repository.
2. Open chrome://extensions (or edge://extensions in Edge) and turn on Developer mode.
3. Click Load unpacked and select the repository folder.

Your browser will say the extension can "read and change data on all websites". That is needed to recognise AI fields on any site; all processing stays on your device.

Development

No build step: the extension is plain JavaScript (Manifest V3) with no runtime dependencies. The browser tests use Puppeteer, installed with npm install.

npm install
npm test                       # unit tests (Node 20+)
npm run test:browser           # Kamelo in a real Chrome, on simulated AI and shop pages
npm run test:sites -- --show   # Kamelo on the real AI sites (nothing is sent)
python3 -m http.server 8765

With the server running, open:

• http://localhost:8765/demo/: a simulated AI chat that shows exactly what would be sent to the AI.
• http://localhost:8765/demo/popup-preview.html: the popup with sample data.

Known limitations

• AI called from a site's own server is invisible to a browser extension. Turn on "Mask every text field" for such a site.
• The network filter only sees text (JSON) requests. Uploaded files (PDFs, images) are not filtered.
• Names are recognised from first-name lists, patterns and memory; a new surname on its own can still be missed. Add important names under "Always protect".
• If an AI rewrites a placeholder (for example "Person 1" instead of [PERSON_1]), it can't be restored.

Contributing

Bug reports, missed detections and pull requests are welcome. Read CONTRIBUTING.md to get started, and look for issues labelled good first issue. Questions and ideas go in Discussions. Everyone taking part follows the Code of Conduct. See the changelog for what changed in each version.

License

Copyright © 2026 Lucas van der Wegen.

Kamelo is open source under the GNU Affero General Public License v3.0 (AGPL-3.0). You may use, study, change and share it. If you distribute Kamelo or a modified version, or offer it as a service, you must share your source under the same license. The code is public so anyone can check exactly what the extension does.

The name Kamelo and the chameleon logo are not covered by the code license. See TRADEMARKS.md.