That Free AI Sidebar on the Club Laptop Could Be Reading Your Supporter List. Here's the 30-Minute Fix.

Somewhere in your club, a volunteer has pasted a list of draw entrants into ChatGPT and typed "tidy this up and write a thank-you email to the winners". It's a sensible use of an AI tool. The risk isn't the AI. It's what else is running in that browser.

Over the past year, security researchers have caught browser extensions with millions of users quietly copying people's AI conversations and sending them to outside servers. Some of them had a "Featured" badge on the official store. If one of those was installed on the laptop your treasurer uses for the club draw, then names, emails and phone numbers of your supporters may have left the building without anyone noticing.

Most clubs will never know whether that happened to them. But the fix takes about half an hour, and it costs nothing.

What actually happened

Three cases worth knowing about, all from the last twelve months:

• December 2025: the "free VPN" that logged AI chats. Koi Security found that Urban VPN Proxy, a free Chrome extension with around 6 million users (plus about 1.3 million more on Microsoft Edge), had been collecting conversations from ChatGPT, Claude, Gemini, Copilot, Grok and other AI tools since an update in July 2025. Sister extensions from the same company did the same, and some of them carried the store's "Featured" label, the badge most people read as "checked and safe".
• January 2026: the AI sidebars. OX Security found two Chrome extensions, with about 900,000 users between them, that sent people's ChatGPT and DeepSeek conversations, plus the address of every open browser tab, to a remote server every 30 minutes. They got permission by asking users to agree to "anonymous, non-identifiable analytics".
• August 2026: the one that came back. One of those sidebars was removed by Google in January. By August it was back in the Chrome Web Store. Netskope Threat Labs reported that a clean-looking version went up first, and an update about two weeks later added new code that people never agreed to. Extensions update themselves in the background, so an add-on that was fine when you installed it can change later.

None of these were aimed at sports clubs. They didn't need to be. They collected everything, from everyone, and a club volunteer's laptop is just another laptop.

Why clubs are more exposed than they think

Most grassroots clubs and small charities run on personal devices. The treasurer's home laptop, the secretary's family PC, a coach's phone. Nobody manages them, nobody checks what's installed, and the same browser that holds the club's draw data also has whatever the kids added for homework or the free VPN someone grabbed for watching football abroad.

The government's Cyber Security Breaches Survey 2025-26, published in May, suggests the sector is moving the wrong way:

• 28% of charities had a breach or attack in the previous 12 months, and phishing was the most common type (25%).
• Among charities with income under £100,000, the share whose leaders call cyber security a high priority fell from 64% to 53% in a year.
• Staff and volunteer training fell from 21% to 17%.
• 22% held personal data without protections such as encryption.

Microsoft's Digital Defense Report 2026, out this month, makes the same point from the other direction: 73.3% of the first steps into an organisation's systems come from people, through phishing, social engineering, stolen logins or someone running something they shouldn't. Attackers go for the easy door. On a volunteer-run laptop, a browser full of unchecked add-ons is the easy door.

What's at stake in a club draw

A club draw holds more personal data than most committees realise: full names, email addresses, phone numbers, sometimes home addresses for posting prizes, plus details of who won what. When that list ends up in a spreadsheet emailed between volunteers, then pasted into an AI chat, it's been copied three or four times onto devices the club doesn't control.

Under UK GDPR, if a breach of personal data is likely to put people at risk, the organisation has to report it to the Information Commissioner's Office within 72 hours of finding out. "We didn't know the extension was doing that" doesn't remove the duty. And the harm to the club isn't just regulatory. Supporters who get a phishing email that uses their name and mentions your draw will stop trusting your draw.

The 30-minute fix: seven checks

1. List every extension on every device that touches club data

In Chrome, type chrome://extensions into the address bar. In Edge, it's edge://extensions. Write down what's there on the treasurer's, secretary's and draw organiser's devices. Most people are surprised by what they find.

2. Remove anything you can't explain

The simple rule: if you can't say who makes it and why the club needs it, remove it. Be especially wary of free VPNs, AI sidebars, coupon finders, PDF converters and "productivity" tools from companies you've never heard of. These are the categories that keep turning up in the research above.

3. Give club admin its own browser profile

Chrome and Edge both let you create a separate profile with its own bookmarks and its own (empty) extension list. Make one called "Club" and use it only for club email, banking and the draw platform. It takes two minutes and means the family's add-ons can't see the club's data.

4. Don't paste the supporter list into AI chats

AI tools are useful for club admin. We've written about what AI agents can now do for club admin and the checks to run on AI-written draw ads. But give the AI the task, not the data. Ask it to "write a thank-you email to a draw winner called [NAME]" and fill the names in yourself. Strip emails, phone numbers and addresses out of anything you paste.

5. Turn on two-step login for the accounts that matter

Club email, the club bank account, your payment provider and your draw platform. If an extension or a phishing email does capture a password, two-step login stops it being enough on its own.

6. Treat new permission requests as a red flag

If an extension you already have suddenly asks for more access after an update, don't click "allow" to make the message go away. Remove it. The August case shows that an add-on can be clean one month and not the next.

7. Write it down in one paragraph

Add a short device rule to your committee minutes: club data only in the club browser profile, no unexplained extensions, no supporter details pasted into AI tools, report anything odd to the secretary straight away. It doesn't need to be a policy document. It needs to exist, so new volunteers know.

Fewer copies, less risk

The safest supporter list is the one that doesn't get copied onto five personal laptops. If your draw runs on spreadsheets passed around by email, every one of those copies is a risk. Running entries, payments and winner selection on one platform means fewer copies of your supporters' details moving between volunteers' devices, and fewer reasons to paste them anywhere. It also makes it easier to deal with the money side cleanly, including winning back failed payments and half-finished entries without anyone exporting a list. If you're setting up a regular draw, our guide to setting up a 100 Club draw covers the basics.

This article is general guidance, not legal advice. If you think supporter data has been exposed, check the ICO's guidance on reporting personal data breaches.

The short version

• Browser extensions with millions of users, some with a "Featured" badge, have been caught copying people's AI chats over the past year
• Club draw data (names, emails, phone numbers) often sits on unmanaged volunteer laptops and gets pasted into AI tools
• Charities are prioritising cyber security less: among those under £100k income, it fell from 64% to 53% in a year
• The fix: audit extensions, remove anything unexplained, use a separate "Club" browser profile, keep supporter details out of AI chats, and turn on two-step login
• A serious personal data breach must be reported to the ICO within 72 hours

Play Fund Win has helped 2,500+ organisations raise £1M+ with online draws that handle entries, payments and random winner selection in one place, so your supporters' details don't have to live in spreadsheets on volunteers' laptops. Start fundraising with PlayFundWin.