A report on AI data exposure · 2026

Your browser had a chattier day than you.

Every prompt you send to ChatGPT, Claude, Gemini, Mistral, Perplexity, or DeepSeek leaves a trail. Over Your Shoulder is a free Chrome extension that shows you exactly where that trail leads — who received what, when, and under which country's laws.

Add to Chrome — Free →

Issue 01 · Spring 2026 overyourshoulder.ch

The trail

Every conversation leaves a trace. You don't see where.

A single question to ChatGPT can generate hundreds of network requests — the answer streams back word by word, each word its own message. Add background telemetry, session pings, suggestions you never asked for, and a quiet conversation becomes a flood of data crossing borders.

You know what you asked. You don't know where the servers are. You don't know which country's laws now apply to your data. You don't know how many times it crossed the Atlantic before you finished your sentence.

Most users never think about it. The companies building these services don't volunteer the information. So we built a tool that answers the question by itself.

The report

A report card for your AI footprint.

Over Your Shoulder observes your browser's outbound traffic to known AI services. It never reads the content of your conversations. It never sends anything to any server. It produces two things:

Feature 01

The badge

A single image that shows your exposure score, the countries you touched, and the companies that received your data. Download as PNG, share on LinkedIn, or keep it for yourself.

Over Your Shoulder badge — a shareable image showing exposure score, countries touched, and vendors contacted

Feature 02

The full report

A PDF that breaks down your score across four factors — volume, category, geography, continuity — with a map, a vendor breakdown, an hourly rhythm, and the legal context for every destination.

Page from the Over Your Shoulder PDF report — four charts showing vendors, hourly activity, score evolution, and destination map

The method

Observation only. Nothing leaves your device.

Over Your Shoulder uses Chrome's webRequest API in read-only mode to detect when your browser contacts an AI service. It records five fields of metadata — timestamp, destination, tab, source, truncated path — and discards the rest.

Metadata

Metadata only.

No request bodies, no response content, no cookies, no authorization headers. We literally cannot read what you asked or what you received.

Storage

Local storage.

Everything stays in your browser's local storage, flushed every 30 seconds to disk, rotated out after 30 days. The extension never connects to an external server.

Silence

No tracking, no telemetry.

We don't know who installs OYS. We don't see your data. We don't get notified when something happens. You own all of it, always.

Beyond the individual

What about your team?

Over Your Shoulder is built for individual awareness. If you're responsible for data governance in an organization — DPO, CISO, IT director — the questions get bigger. How are your teams using AI services? Across which tools? Toward which jurisdictions?

We're building the answer. It's called Symbiont, and it's coming soon.

Leave your email.

We'll tell you when it's ready.

One email, no follow-up.