Privacy notice · Current data flow
Privacy and data boundaries
The current version requires no account. Detection input is processed locally in your browser, and the application code does not upload text, images, or video to a backend. This notice separates detection content, browser preferences, and ordinary request metadata handled by the hosting platform.
01 · Detection content
The front-end code uses page memory and browser media capabilities. It makes no content-upload request and does not write detection input to persistent browser storage.
Pasted text remains in the input and page memory while repetition, sentence length, punctuation, and character heuristics are calculated. The application does not send text to a server or write it to localStorage, cookies, or a site database. Refreshing or closing the page clears the page state.
The browser uses the File API, a temporary object URL, an image element, and Canvas to read pixels and dimensions from the selected file. The analysis code does not upload the image. Temporary URLs are revoked after preview loading, replacement, removal, or analysis, while the original file remains under device control.
A browser media element and temporary object URL expose duration, resolution, file size, MIME type, and container information. The current version does not upload or inspect frames or send audio. File removal, replacement, or the end of the page session invalidates the temporary browser reference.
02 · Browser and network
The site stores one interface preference. Visiting the page still communicates with Cloudflare hosting infrastructure, but those requests do not contain input text or selected media files.
Choosing light or dark theme stores the key gendetect-theme with the value light or dark in localStorage. It contains no detection content, filename, score, or identity information. You can remove the preference through the browser’s site-data settings.
To return HTML, CSS, scripts, fonts, and icons, Cloudflare may process an IP address, User-Agent, requested URL, timestamp, response status, and security diagnostics. Infrastructure-log retention is controlled by the Cloudflare service. These page requests do not carry detection input.
The current front-end code includes no website analytics, advertising, behavioral tracking, third-party login, or content-processing SDK and sets no application cookie. Browser extensions, device-management software, network proxies, and external links opened by a user are outside the front-end code’s control.
03 · Retention and security
Local processing reduces the paths by which content leaves the device, but shared devices, browser extensions, screen recording, and malicious software may still access material opened in a page.
There is currently no backend API that receives detection content, so GenDetect servers have no text, image, or video copy to retain, sell, train a model on, or share with another content processor. Ordinary page-request logs and detection input are different data categories; this does not make every visit anonymous.
Text, results, and selected-file references primarily exist in current page memory. Clearing the input, removing a file, refreshing, or closing the page ends the corresponding state. Browser history, cache, crash recovery, or form restoration remain subject to your browser settings.
Before opening unpublished work, personal media, or confidential material on a shared or managed device, review screen sharing, extension permissions, download locations, and local-account isolation. No local web page can prevent software with device access from reading the screen or memory.
04 · Future changes
A future recognition or processing API, account, or cloud task would change the data flow. Before launch, this notice and the methodology must state purpose, recipients, retention, security, and user controls.
If detection content is later sent to a first-party or third-party backend, the interface must explain before submission which fields or files leave the device, what recognition or processing purpose applies, who provides the service, whether data supports training, and what happens after failure or cancellation.
If login, history, or cloud tasks are introduced, the notice must list account identifiers, stored content, result history, access controls, deletion methods, and a defined retention period. The current no-account and local-detection statement cannot automatically cover capabilities that do not yet exist.
This notice describes the current front-end implementation on the displayed last-updated date; it is not a retroactive promise about every browser, Cloudflare, or future service. Supplier or capability changes require updated copy, methodology, interface notices, and verification against actual network requests.