Why I built a "Safe Room" for AI prompts after watching a major data leak
Hi Indie Hackers,
I’m a Product Designer, and for a long time, I’ve carried a specific kind of "copy-paste anxiety." It started years ago while I was working at a large consultancy, where I watched firsthand as a single, innocent AI prompt turned into a major data leak. Ever since that day, that nagging fear has stuck with me every time I use an LLM.
The breaking point came recently when I found myself wasting an entire evening manually scrubbing a document just so I could safely ask an AI for help. It was soul-crushing work. When I went looking for a tool to help, I realized that it’s surprisingly hard to find something that just does one thing well.
Most of what's out there is either over-engineered SaaS product or sketchy "privacy" wrappers that require you to upload your data to "their" servers to be cleaned.
In turn, which just replaces one trust problem with another.
So, I built ScrubZero.
It acts as a smart, local filter that redacts names and bank details before they reach the AI or served as a template. Paste your text, and ScrubZero handles the detection automatically. You can then manually refine the tags for a more precise redaction, ensuring every piece of data is safe before it leaves your machine.
Think of it as a "safe room" for your data. Because the cleaning happens entirely on your own device, your private information never actually touches the internet.
Since this is an early build, I’m actively refining the detection logic to make it as bulletproof as possible and I’d love your help in stress-testing it.
You can try it out here
To submit a feature request, you can do it here
Most people have experienced that "copy-paste anxiety" where you realize halfway through an AI prompt that you've accidentally included a client's full name or a sensitive project ID. It is incredibly stressful to think that a simple request for a summary might have just permanently added your private company data to a model's training set. Since you are positioning ScrubZero as a "safe room" that runs entirely in the browser, how do you balance the heavy processing required for high-accuracy PII detection with the performance constraints of a local, client-side environment?
Exactly. That anxiety eventually turns into self-doubt about what else you might have missed before ingestion.
Currently, ScrubZero uses a two-step approach:
Rule-based identification handles the obvious patterns first, followed by a local AI model that looks at contextual proximity to catch the nuances. It works well for standard documents, but I’ve kept manual tagging as a core part of the UX for those edge cases AI might miss.
As for heavy processing, I'll be honest.. it isn't there yet. Large CSV datasets are still a challenge in early testing, but those hurdles are helping me refine the redactor worker and see exactly how far we can push WebGPU.
That two-step logic with WebGPU is a clever way to keep things private without sacrificing too much speed.
It sounds like you are hitting the exact same bottleneck many technical founders face when trying to keep things local because optimizing that redactor worker is what actually builds long-term user trust.
By the way the way I work with digital PR and media placement can help bridge that trust gap even further since high authority features on sites like Bloomberg or AP News give privacy tools the institutional credibility they need to scale.
Keep pushing those WebGPU limits because the local first niche is definitely where the savvy users are heading.