Privacy

Short version: we take no account, no email and no name. Your manuscript is sent to the model providers listed below and deleted on the schedule below.

What we hold

• Your manuscript — the uploaded file, the text extracted from it, and the cleaned text that was graded.
• Your passphrase — only as a keyed hash; we cannot read it back or recover it for you.
• Your IP address — only as a keyed hash, to apply per-network limits.
• The result — score, journal groups, summary and observations.

We never see your email address or card details. Stripe collects those for the payment and sends its own receipt.

Who sees the manuscript

For paid grading, cleaning, summarising and matching run through OpenRouter to three models: Gemini 3.7 Flash, GLM 5.3 Flash and Kimi K3.

• Gemini: Google Vertex, with its priority service as backup.
• GLM: Z.AI, with Baseten, Modal and CoreWeave as backups.
• Kimi: Moonshot, with Modal as backup.

Every request for paid grading refuses provider data collection and requires an endpoint that OpenRouter classifies as zero data retention. Fallbacks are restricted to the providers above and must pass the same privacy filters. OpenRouter's zero-retention definition permits temporary in-memory processing and prompt caching, but excludes persistent storage of prompts and responses by the model endpoint. See OpenRouter's zero-retention policy.

No model is given web search or any other tool. Cleaning replies are processed in memory and discarded. Other provider responses are kept for auditing on the schedule below.

How long we keep it

The uploaded file

Discarded immediately after text extraction, including if extraction fails. We keep only file metadata.

Extracted, supplementary and cleaned manuscript text

Kept temporarily while the run needs it, then deleted as part of completing, failing or expiring the run. Unpaid runs expire after 30 minutes; the worker checks every 30 seconds.

Full cleaning-model responses

Processed in memory and discarded immediately after use, including rejected or failed attempts. Never saved in the call history.

Other raw provider responses

90 days, then reduced to usage and cost. Request records contain parameters and message hashes, not manuscript content.

Result, summary, observations and supporting grading records

12 months, then deleted.

Passphrase hashes, run and payment metadata

No automatic expiry. This includes filenames, file hashes and the IP hash associated with a run. Separate IP rate-limit events are deleted after 30 days.

New backups exclude temporary manuscript text. Retained results and metadata are included in encrypted backups, with 14 daily, 8 weekly and 12 monthly recovery points; deleted records may therefore remain in backups for up to another year.

Fonts, scripts and cookies

The pages use the fonts already on your device and load no analytics. The only third-party script is Cloudflare's bot check on the upload form; Stripe's checkout page has its own privacy notice. We set no cookies of our own.

Contact

Ask for deletion, or anything else, through the address on the receipt Stripe sends you. Quote the run link — it is the only way we can find your run.