A copy wasn't masked
Check that Auto-mask is ticked in the menu and that PasteGuard isn't paused. Auto-mask needs no permission: it masks the copy on the clipboard, so a normal ⌘V pastes the masked text. If the value is something the rules don't know, open the menu and, under Last copy, choose Mark Sensitive (⌃⌘M) or Mark As.
Something was masked by mistake
Under Last copy in the menu, choose Show Original to put the copy back as it was, or Ignore (⌃⌘I) so that text is never flagged again. Ignored text is listed in Settings › Detect, where you can remove it.
Restoring originals
Copy an AI reply that contains tokens such as [EMAIL_1] and press ⌃⌘R, or choose Restore Originals in the menu. Originals are kept in an encrypted vault on your Mac for 1 hour, 24 hours or 7 days.
Safe Paste and Smart ⌘V
With Auto-mask off, Safe Paste (⌃⌘V) masks and pastes in one go, and Smart ⌘V checks a normal ⌘V in the apps you choose under Settings › Apps. Both press keys for you, so they need Accessibility: open System Settings › Privacy & Security › Accessibility and turn on PasteGuard.
Import a CSV list (Pro)
In Settings › Detect, under Imported lists, click + and drop or choose a CSV. Every cell becomes a value to mask, as Name, Company, Secret or Other. All lists together can hold up to 1,000 rows and 1 MB.
Custom rules
Custom rules (Pro) hide things only you know are private: client names, project codenames, your company's ID formats. Open Settings › Detect, and under Custom rules click +. Give the rule a name, then choose:
- Terms: exact words or phrases, one per line. Whole words only, any capitalisation, so “Acme” doesn't match inside “Acmeville”.
- Pattern: a regular expression, for IDs that follow a format.
The Examples menu in the rule editor fills in any of these to start from:
| Rule | Type | Terms or pattern | Hides |
|---|---|---|---|
| Client and people names | Terms | Acme CorpJordan Lee | Acme Corp, Jordan Lee |
| Project codenames | Terms | Project FalconBluebird | Project Falcon |
| Employee ID | Pattern | \bEMP-\d{5}\b | EMP-10234 |
| Customer ID | Pattern | \bCUS-\d{6}\b | CUS-482913 |
| Invoice number | Pattern | \bINV-\d{4}-\d{4,}\b | INV-2026-00871 |
| Ticket ID | Pattern | \b(?:JIRA|OPS)-\d+\b | JIRA-88, OPS-4412 |
| Vietnamese phone number | Pattern | (?:\+84|0)(?:3|5|7|8|9)\d{8}\b | 0912345678 |
| Vietnamese ID card (CCCD) | Pattern | \b0\d{11}\b | 001203004567 |
Matches are masked like names, keeping each word's first letter: Acme Corp becomes A*** C***. The rule's name is how it's listed in the menu and the capsule.
Emails, phone numbers, card numbers, bank accounts and API keys are already found without a rule. When a built-in rule matches the same text first, the value is still hidden but shows under the built-in name. Names are found on their own only after words like “customer” or “contact”, so list the people and companies that must always be hidden under Terms.