Privacy Policy

The short version

AI or Not is run by one person. We collect the minimum needed to run a detection service: the content you ask us to check, a few account details if you sign up, payment references if you buy credits, and the usual technical logs and analytics. We don't sell any of it, don't use it for advertising, and don't train models on your content. You can ask us to show, correct or delete what we hold about you at any time by emailing support@aiornot.tools.

The rest of this page spells that out.

Who is responsible

aiornot.tools is operated by an individual developer, who is the data controller for the processing described here. Contact: support@aiornot.tools. This policy applies to everyone who uses the site — anonymous visitors, signed-in users and paying customers.

What we collect, in each situation

When you visit the site

Technical logs. Our hosting provider records the IP address, browser type, requested URL and time of each request, as every web server does. We use these to keep the site running and to stop abuse.
Analytics. We use Google Analytics and Microsoft Clarity to understand how the site is used: pages visited, buttons clicked, how far people scroll, device and browser type, and approximate location derived from your IP address. Clarity can also record anonymised session replays of how a page is used, with form input masked by default. This is for improving the product only. Both tools set cookies, listed in the Cookie Policy.

When you run a check without an account

An anonymous identifier. A cookie named aiornot_anon holds a random ID so we can count your free checks for the day. It isn't linked to a name or an email address.
The content you submit. Text is sent to the detection model and is not kept as a document; we store a fingerprint of it (a one-way hash) plus the result, which for text includes any passages that were flagged. Files — images, video, audio — are stored so they can be analysed and so an identical upload returns the same result without being processed again.
The result — probability, confidence and, for files, the likely generator — kept with the fingerprint in a result cache so identical content can reuse an earlier answer.
Request details — IP address and browser user agent — logged with each check to detect abuse of the free limits.

Account details from your Google account: email address, name, profile picture and the Google account identifier. You can change the name and picture in your settings.
Sessions. Each sign-in creates a session record with the IP address and browser used. Sessions expire after 7 days.
History. Your checks are saved to your account: the file name and size, or a fingerprint of the text, the result, and the time. Anonymous checks made in the same browser before you signed in are attached to your account when you sign in, so you don't lose them.
Credits. A ledger of credits granted, spent and refunded.
Daily challenge. If you play, your answers, score, lives and streak, by account and day.

When you buy credits or a subscription

Payments are processed by Waffo, our merchant of record. Waffo collects your payment details, billing address and whatever tax information applies, under its own privacy policy. We receive the order reference, the plan or pack you bought, the amount, the subscription status and a customer reference, so we can credit your account and handle refunds. We never see your card number.

When you contact us

Emails and contact-form messages reach our support inbox, with your address and whatever you wrote, so we can reply and keep a record of the conversation.

Why we use this data

To provide the Service you asked for — running checks, returning results, keeping your history and credit balance, and signing you in. This is necessary to perform our agreement with you.
To keep the Service secure and fair — preventing abuse of free limits and detecting fraud and attacks. This is in our legitimate interest, and we think in yours.
To process payments and comply with tax and accounting law.
To understand usage and fix problems, using analytics. Where your local law requires consent for analytics cookies, the Cookie Policy explains how to withhold or withdraw it.
To answer your messages.
To meet legal obligations and respond to lawful requests.

Who processes data on our behalf

We don't sell personal data and don't share it with advertisers. The following kinds of providers process data to run the Service, each limited to that purpose:

Hosting, storage and database — Cloudflare, which serves the site, stores uploaded files and holds our database.
AI detection models — third-party providers that analyse the content you submit and return a result. They receive the content itself and nothing that identifies you.
Payments — Waffo, as merchant of record (see above).
Sign-in — Google, when you sign in with your Google account.
Analytics — Google Analytics and Microsoft Clarity.
Email delivery — the provider that sends our sign-in and support emails.

We may also disclose data where the law requires it, to protect the rights and safety of users or the public, or in connection with a transfer of the Service to a new operator — in which case we would tell you before a different policy applied.

Because these providers operate internationally, your data may be processed outside your own country, including in the United States. Where the law requires it, transfers rely on the providers' standard contractual safeguards.

How long we keep it

Your history and account data — until you delete individual items or your account.
Result cache and content fingerprints — for as long as they're useful for returning results. You can ask us to remove entries tied to your content at any time.
Uploaded files — kept to produce your result and to serve the same result if the file is checked again; removed on request.
Sessions and request logs — sessions expire after 7 days; hosting logs are kept briefly by our hosting provider.
Payment records — for as long as tax and accounting law requires. Waffo keeps its own records under its policy.
Support emails — as long as needed to deal with the matter and keep a record of it.
Analytics — according to Google's and Microsoft's retention settings for anonymised usage data.

Your rights and how to use them

Wherever you live, you can ask us to:

Show you your data. Email us and we'll send a copy of the personal data we hold about you — account details, history, credit ledger — in a readable format.
Correct it. Your display name and avatar can be changed in Settings → Profile. For anything else, email us.
Delete some of it. Ask us to remove specific history entries, cached results or files tied to your content, and we will.
Delete your account. The process is below.
Object or restrict. You can object to analytics by blocking the cookies described in the Cookie Policy, and you can ask us to stop a particular kind of processing.
Take it with you. On request we'll provide your data in a machine-readable format.

If you live in the EU/EEA, the UK or another jurisdiction with a data-protection authority, you also have the right to complain to that authority. We'd appreciate the chance to put things right first.

How a request works

Email support@aiornot.tools from the address on your account and say what you want — a copy of your data, a correction, deletion of specific items, or closing your account.
We confirm that the request came from the account holder. Writing from the registered address is normally enough; if there's any doubt, we'll ask you to confirm from inside your signed-in session.
We carry out the request within 30 days and confirm by email. If it will take longer — it rarely does — we'll tell you why and when.

What account deletion involves

When you ask us to close your account we:

delete your account record, sign-in sessions and profile;
delete your detection history and the credit ledger attached to your account;
remove uploaded files and cached results that are linked to you;
cancel any active subscription through Waffo, so you aren't charged again.

Payment records that tax law requires us to keep are retained for the statutory period, separated from your profile. Analytics data that was anonymised at collection can't be linked back to you and isn't affected. Deletion is permanent, and unused credits aren't refunded except under the refund terms in the Terms of Service.

Security

All traffic uses HTTPS. Data is encrypted at rest by our hosting provider, access to production systems is limited to the operator, and sign-in is delegated to Google, so we never hold a password for you. No system is perfectly secure; if a breach affects your personal data we'll notify you, and any authority the law requires, within the legally required timeframe.