💡 Inspiration Over 97% of digital consumers click "I Agree" to Terms of Service agreements without reading them. Average privacy policies run between 3,000 and 7,000 words long and take up to 25 minutes to analyze. Corporations exploit this friction by burying forced binding arbitration, class-action lawsuit waivers, automatic recurring billing, and uncompensated AI model data training deep inside dense legalese. We were inspired to build EthiScan to level the playing field, democratize legal literacy, and give everyday users an automated real-time legal guardian inside their browser.
🛡️ What EthiScan Does EthiScan is a Manifest V3 Chrome extension that acts as a real-time legal shield. Whenever a user visits any website or terms page, EthiScan automatically audits the document, assigns an instant A through F Trust Grade with a safety score from 0 to 100, generates a 3-line plain English summary, and underlines predatory clauses directly on the webpage with interactive hover tooltips. Users can also select custom privacy presets such as Standard Consumer, Strict Media Protection, or Regulatory Compliance.
⚙️ How We Built It We engineered EthiScan using a decoupled multi-tier cloud pipeline. The frontend extension is built on Chrome Manifest V3 using event-driven background service workers for zero battery drain. For the backend, we built a stateless serverless proxy hosted on Vercel Node.js infrastructure that receives policy text, secures API credentials server-side, and queries the Google Gemini 1.5 Flash LLM using structured JSON prompt schemas. For in-page visual highlighting, we encapsulated all tooltips inside an isolated Shadow DOM container to prevent external host website CSS from breaking our extension layout.
🎓 What We Learned Throughout this project, we deepened our technical expertise in serverless cloud engineering, security-first API design, and Generative AI prompt optimization. We learned how to map unstructured legal text against international data protection frameworks like GDPR, CCPA, PECA, and PIPEDA. We also gained crucial insights into building accessible, privacy-first tools that operate statelessly without logging or storing user browsing history.
🚀 Challenges We Faced Reading PDF Streams: Native Chrome PDF viewers block standard DOM content scripts. We solved this by developing a background fetch system that extracts raw PDF binary stream text directly. Securing API Credentials: Code stored inside browser extensions can easily be inspected by users. We solved this by routing requests through a stateless Vercel Serverless Proxy handling environment variables securely on the cloud. Website Style Conflicts: Host website CSS rules frequently override extension popups and formatting. We solved this by encapsulating all in-page elements inside an isolated Shadow DOM root node.
Log in or sign up for Devpost to join the conversation.