1. The short version

• We do not store the text you analyse. It is processed in memory and discarded — unless you choose to create a shareable verification link, which saves a copy for 180 days so others can open it.
• Optional features that remember your scans (My recent scans, and My classes on Pro) keep them in your own browser, on your computer, not on our servers.
• We never use your text to train models and never sell it.
• We keep the minimum needed to run your account: your email, plan, and usage counts.
• You can delete your account — and everything above — yourself, at any time.

2. What we collect and why

Account data. Your name, email address, and a salted hash of your password (or your Google account identifier if you sign in with Google). Used to operate your account, verify your email, and send transactional messages such as password resets. Legal basis (GDPR): performance of our contract with you.

Usage data. For each account we keep simple monthly totals: the number of scans you ran, the number of words checked, the number of reports you exported, and when you last ran a scan. API keys have their own usage totals. We use these totals to apply your plan’s limits and to understand how ScribeLens is used, so we can improve it. Only the ScribeLens team can see these totals. The totals never include what you scanned: we do not keep your text or the files you upload, so we cannot see your content. The one exception is a verification link, which only you can create: we then keep a copy of that report for 180 days so others can check it. Legal basis: performance of our contract with you, and our legitimate interests in preventing abuse and improving the service.

Anonymous scan measurements. For each analysis we may record the numeric signals the detector produced and a one-way cryptographic fingerprint (SHA-256 hash) of the normalised text. A hash cannot be reversed into your writing. These measurements let us monitor and improve detection accuracy. The text itself is not written to any database or log. Legal basis: legitimate interest in maintaining detection quality.

Anonymous visit statistics. To learn which pages are useful, we count visits without cookies, without storing anything in your browser, and without any identifier. For each page we record: the page, the website or campaign link that referred you, your browser’s time zone (as a rough location), whether you are on a phone, tablet or computer, how long the page was open and how far you scrolled, and which links or buttons were clicked. We never record your IP address, anything you type or paste, or anything that could identify you, and these counts cannot be linked to you or to your account. Legal basis: legitimate interest in understanding and improving the site.

Guest usage. For visitors without an account, a derived identifier based on network information is used solely to enforce daily free limits.

Verification links (only if you create one). If you choose to create a shareable verification link for a report, we store a copy of that report — including the analysed text — so anyone with the link can open it. This is the one case where your text is stored, it happens only when you ask for it, and the link is unguessable. The stored copy is deleted automatically after 180 days. Do not create a link for a document you do not want others to be able to read.

3. What we do not do

• We do not store submitted text, except the copy saved when you create a verification link yourself (see above).
• No publication or resale of submitted text.
• No training of AI models on your submissions.
• No advertising trackers and no sale of personal data. We have never sold personal data.

4. How long we keep data

• Account and usage data: for as long as your account exists. Deleting your account removes your account record and API keys immediately and permanently.
• Email verification links: expire after 24 hours.
• Password reset links: expire after 1 hour and are single-use.
• Anonymous scan measurements: retained for accuracy monitoring; they contain no personal information and cannot be linked back to you or your text.
• Anonymous visit statistics: kept in our server logs; they contain no personal information and cannot be linked back to you.
• Verification-link reports: the stored copy of a report you shared is deleted automatically 180 days after you create the link.
• Support emails: kept as long as needed to resolve your request.

5. Cookies and local storage

We do not use advertising cookies or third-party analytics trackers, and our own visit statistics (see section 2) use no cookies or browser storage at all.

To make the site work, your browser keeps a few small items. None of them are shared with other companies.

• your sign-in token, so you stay logged in
• your latest analysis, so it survives a page reload (this tab only)
• whether you turned writing tips on, and whether you chose to keep a scan history
• the name you gave your last scan
• whether you closed the review prompt
• a promo code from a link you opened, until it is added to your account (at most 7 days)

Kept only in your browser, if you choose it. If you turn on My recent scans, your last 25 scans (the text and the results) are saved in your browser’s own storage on that computer, so you can open a report again later. If you use My classes (Pro), the class assignments you save, including the documents’ text and results, are saved the same way. This data is never sent to us and we cannot see it. You can delete it at any time on those pages, by turning history off, or by clearing your browser’s data for this site. Don’t use these features on a shared computer.

Google’s sign-in widget may set its own cookies when you choose to use it, governed by Google’s policies. Because we do not track you across sites, we treat all visitors the same regardless of browser “Do Not Track” signals — there is no tracking to turn off.

6. Service providers we rely on

• Cloud infrastructure providers (United States) — application hosting, database, and email delivery.
• Third-party sign-in — if you choose to sign in with a third-party provider (such as Google), that provider shares your name, email, and account identifier with us and applies its own privacy policy to the sign-in.
• Payment providers (such as Stripe or Coinbase Commerce) — where payments are offered, they process your payment details; we receive only confirmation of payment, never your card number.

These providers process data on our instructions and may not use it for their own purposes.

7. Where data is processed

Our servers run in the United States. If you use the Service from the EU/EEA, UK, or elsewhere, your account data is transferred to and processed in the US. Our providers offer standard contractual safeguards for such transfers (EU-approved data processing terms).

8. Security and breach notification

Passwords are stored only as salted one-way hashes; connections are encrypted in transit; outbound email is authenticated; and access to production systems is restricted. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and, where required, the relevant authorities without undue delay.

9. Your rights

Depending on where you live (including under the GDPR and CCPA/CPRA), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data — the Account page does this directly;
• Export your data in a portable format;
• Object to or restrict certain processing;
• Not be discriminated against for exercising any of these rights;
• Complain to your local data-protection authority.

Most of these are self-serve on the Account page. For anything else, email support@scribelensai.com and we will respond within 30 days. We do not sell personal data, so there is nothing to opt out of under “Do Not Sell or Share” laws.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Changes and contact

Material changes to this policy will appear on this page with a new effective date. Questions or requests: support@scribelensai.com