Privacy notice · Current data flow
Privacy and data boundaries
No account is required. Enabled detection services are selected automatically, with consent before upload and any external processing. Text stays in the browser when specialist text detection is unavailable. Google Analytics 4 measures usage without receiving detection input.
01 · Detection content
Detection follows enabled service capabilities. Server analysis requires explicit consent; local supporting checks apply when server detection is not enabled. Detection input is not written to persistent browser storage.
Pasted text remains in the input and page memory while repetition, sentence length, punctuation, and character heuristics are calculated. Local mode does not upload text. Full analysis sends text to our API and, when needed, the disclosed Copyleaks service. We do not retain the original text; only results and task fingerprints are stored temporarily. Text is not written to localStorage or cookies. Refreshing or closing the page clears the page state.
After consent, server image analysis uploads the original to our API and private inference service for metadata, C2PA and model checks. Specialist review only uses disclosed, authorized providers. Local checks apply when server detection is not enabled. Legacy Gemini/Verify endpoints retain their own disclosures.
After consent, server video analysis uploads the original, potentially including audio, and checks at most six frames from videos up to 120 seconds. Audio and temporal continuity are not analyzed. Only sampled frames may be sent to disclosed, authorized specialist providers. Completed uploads are deleted; interrupted uploads expire within one day.
02 · Browser and network
GenDetect itself stores only a theme preference. Google Analytics 4 may use cookies or local identifiers for usage statistics. Analytics events exclude detection input; text or media is uploaded only after server analysis is consented to.
GenDetect stores only gendetect-theme in localStorage and does not persist the image mode, detection content, filename, or score. Google Analytics 4 may use cookies or local identifiers to distinguish browsers and sessions. These values can be removed through browser site-data settings.
To return HTML, CSS, scripts, fonts, and icons, Cloudflare may process an IP address, User-Agent, requested URL, timestamp, response status, and security diagnostics. Infrastructure-log retention is controlled by the Cloudflare service. These page requests do not carry detection input.
The site uses Google Analytics 4 (measurement ID G-2M0XZ9X6Y1) to measure page URLs, referrers, browser and device information, approximate geography, and usage events enabled by the GA4 property. Google may receive request data such as an IP address and use cookies or local identifiers. GenDetect does not send pasted text or selected images and videos as analytics event parameters. Remote checks still load Cloudflare Turnstile on demand.
Read the Google Privacy Policy03 · Retention and security
Local processing reduces the paths by which content leaves the device. Remote media is deleted after completion, with a one-day lifecycle backstop for interrupted uploads. Full-analysis results become inaccessible after 24 hours and their content is cleared within the following hour. Budget records and task fingerprints without original text remain for at most 30 days.
The same-origin API stores media privately under a high-entropy task ID and deletes it after completion. Necessary metadata, results, input fingerprints and budget reservations follow the retention schedule above. Original text is not written to logs or result caches. GenDetect does not use them for training, sales, advertising, or account history.
Full analysis may send text to Copyleaks and images or sampled video frames to Sightengine. Provider names and privacy links are shown before submission. Legacy Gemini/Verify disclosures still apply to their legacy tasks. Each provider handles its copy, logs, and retention under its own policy, outside GenDetect’s deletion schedule. Review the policies shown in the interface before using sensitive images.
Text, results, and selected-file references primarily exist in current page memory. Clearing the input, removing a file, refreshing, or closing the page ends the corresponding state. Browser history, cache, crash recovery, or form restoration remain subject to your browser settings.
Before opening unpublished work, personal media, or confidential material on a shared or managed device, review screen sharing, extension permissions, download locations, and local-account isolation. No local web page can prevent software with device access from reading the screen or memory.
04 · Future changes
Configurable full analysis is implemented. A new provider, account, or cloud-history feature would change the data flow again and must state purpose, recipients, retention, security, and user controls before launch.
Before adding a first-party processing path or third-party provider, the interface must explain which fields or files leave the device, what recognition or processing purpose applies, who provides the service, whether data supports training, and what happens after failure or cancellation.
If login, history, or long-lived cloud tasks are introduced, the notice must list account identifiers, stored content, result history, access controls, deletion methods, and a defined retention period. The current no-account and upload-consent statement cannot automatically cover capabilities that do not yet exist.
This notice describes the current front-end implementation on the displayed last-updated date; it is not a retroactive promise about every browser, Cloudflare, or future service. Supplier or capability changes require updated copy, methodology, interface notices, and verification against actual network requests.