Private by design
Bluff reads the shape of a page, never what you typed into it. Forwarding a message is your choice, and the message is dropped as soon as the verdict is made.
What leaves your device
| Data | Leaves your device? | Notes |
|---|---|---|
| What you type into a page (card number, CVV, password, SSN) | Never sent | The extension never reads input values. |
| Page text and screenshots | Never sent | Only yes/no signals such as "has a countdown timer". |
| Domain of the page | Sent | Needed to check the site and to link later charges to it. |
| Which kinds of fields the page asks for | Sent | For example "card number" and "CVV", never the values. |
| Yes/no page signals | Sent | Gift-card-only, countdown timer, no contact page, and similar. |
| A text or link you paste or forward | Sent by you, then discarded | Used for the verdict and then dropped. Only the verdict is kept. |
| Your card statement | Never sent | This demo uses synthetic charges only. No real customer data. |
Other promises
- Bluff never files, sends or pays anything for you. Disputes are drafts you review.
- When the AI check is on, Bluff's server fetches the checked site's public pages itself (never your session on the page or anything you typed) and sends their text, with registry facts and the rules findings, to NVIDIA Nemotron for the verdict: up to 8 pages for a store check, up to 10 per merchant website in the bank scan.
- This demo shares one sample user (“Maya”), so deleting data resets the demo for everyone.
- All stores and charges are synthetic and labeled as demos.
Delete everything
Clears exposures, verdicts, texts, disputes and game data, then re-creates the sample user.