What Clotr does, and doesn't

I'd rather you check this page than believe it. Every line below names the file, the test or the setting that backs it, so you can read the same source I'm describing instead of taking my word for it.

What leaves your computer

Nothing. Clotr reads what you type, in the page, on your device, and keeps a short record of what kind of thing it found. It has no server to send anything to, and nothing it does needs an account.

  • Open chrome://extensions, turn on Developer mode, and click Clotr's service worker. Watch its Network tab while you use an AI chat: it stays empty.

  • Read the rule test named "100% local: no network calls, no remote code." It fails the build the moment anyone adds code that could send data out, and it checks Clotr for Windows the same way.

  • Look at the source yourself: detection runs in patterns.js, plain text matching with no AI model and no call to one.

What it costs

Nothing, and there's no account to make it work. The code carries no payment library and no sign-in screen, because there's nowhere for a password to go.

  • Search the source for a login page or a billing call: there isn't one.

  • The team pack, for organizations, is the one thing Clotr sells, and it changes nothing about how the free extension behaves. Its terms are on the Clotr for teams page of this site.

  • It's free software under AGPL-3.0-or-later: free to use, and free to stay that way, because the license doesn't allow a closed-source fork.

Which sites it watches

Clotr watches 19 AI chat sites the moment you install it, and nothing else, until you say so.

  • The 19 are listed in ai-sites.json, and the extension's permissions, visible on its store listing or in your browser's own extension settings, name each one by address. There's no permission that covers "AI sites in general."

  • Email and chat apps, Gmail, Outlook, Yahoo Mail, Discord, Slack, WhatsApp, Messenger and Microsoft Teams, stay off until you tick them, on the welcome page or in Settings, and your browser asks you to confirm each one. The list is EVERYDAY_SITES in sites.js.

  • Add any other site yourself, one at a time: clicking Protect this site asks your browser for that one address only, never a broader pattern, in popup.js's permission request. The manifest declares that Clotr may ask for one site at a time; it's the per-click request, not the manifest line, worth reading if you want to see the actual limit.

Scam messages

"Is this a scam?" is Clotr's own page: paste a message you got by text, email or chat, and it marks the wording that real scams use, in English or Spanish, and says what each sign means. It never tells you a message is safe, because no list knows every scam, and the message you paste is never sent, saved or logged anywhere.

  • The signs it looks for are plain text matching in scam-signs.js, built from real scam-message research, not a model's guess.

  • Run npm run scorecard in the source to see how many warning signs it finds in a set of real and made-up scam messages, and how often it finds one that isn't there, straight from scorecard.js.

  • After a scam, or a near miss, Tourniquet can ask before sending money or an ID number for 30 days, then step back down by itself. It's your own setting, stored on your device, never Clotr's to turn on for you.

The code

Clotr is open source under AGPL-3.0-or-later, and every release can be rebuilt from that source, byte for byte.

  • Read it on GitHub: github.com/clotr-app/clotr. Nothing about how Clotr decides what to warn about is hidden, licensed separately or kept server-side.

  • Build the release zip yourself with npm run package, and compare its checksum against the SHA256SUMS.txt published with that release. They match, because the build only ever packages what git tracks.

Check it yourself

Three ways to see this working, not just read about it, in about ten minutes.

  1. Load Clotr, open DevTools (F12), go to the Network tab and tick Offline, or turn off your computer's network entirely. Open a built-in AI chat and paste the test key AKIA4HPQ7XZ2R6TWLJ3N into the message box. The warning still appears, because catching it never needed a connection.
  2. Clone the repository, run npm install, then node --test --test-name-pattern="100% local" tests/rules.test.js. It passes by scanning every file Clotr ships for a network call; comment out a guard in rules.test.js yourself and run it again to see it fail instead.
  3. Check out the tag of a release you've installed, say git checkout v1.3.0, then run npm run package. It writes dist/clotr-<version>.zip and a line for it in dist/SHA256SUMS.txt. Open that same release on GitHub and compare your line against the SHA256SUMS.txt attached there: the same source always produces the same bytes.

What it can't do

Clotr warns and lets you decide; it isn't a filter that blocks anything on its own, and it can't protect what it can't see.

  • It never stops a message by itself. Every warning ends in your choice, and the strictest setting a person, a team or Tourniquet can apply still only asks first.

  • A site that's actively hostile to Clotr, not just an AI chat behaving normally, can remove its warning from the page. When that happens Clotr notices and stops holding messages there instead of failing silently, which you can read about in the "Accepted limits" section of the security review.

  • It reads text, not images: a picture's hidden location and a suspicious file name get checked, but a password written across a photo of a screen doesn't.

  • No test set covers every scam or every way a detail can be written. If Clotr misses one, or warns about nothing, tell me.