Privacy policy

01/Who we are

AuthorText (authortext.com) is a personal project of one person who lives in Portugal. It is not a company, so there is no company name, registration number or postal address. The data controller in the sense of the GDPR is the owner of the project. Contact: [email protected].

02/Your texts

The text you check is processed in the memory of the server and forgotten right away. We do not store texts, do not write them to logs and do not use them to train models. The same holds for a text loaded from a file or by link: the server downloads the page, takes the main text from it and stores nothing.

The error log holds only the line about the failure, never the content of a text.

03/Account

To sign in we keep a login, a salted hash of the password (we do not know your password and cannot remind you of it), optionally an e-mail address, and the plan. If you sign in with an e-mail code or with Google, we keep the address the code was sent to or the one Google reported.

E-mail codes are kept only as a hash, are valid for 10 minutes and allow 5 tries; the body of the message is blanked after delivery. An API key is kept only as a SHA-256 hash and is shown once, when it is created.

Payments are processed by PayPal. We receive from it only the subscription status and the payer identifier; we never see or store bank-card data. What stays with us is the plan, the status and the dates of the subscription.

04/Sign-in with Google

When you press "Sign in with Google", your browser gets proof of identity (an ID token) from Google and sends it only to Google and to our server. The server verifies the signature and keeps the e-mail address from the token. We do not ask for any other Google profile data. For the button to work the page loads a script from accounts.google.com; there are no other external scripts, ads or trackers.

05/Statistics without tracking

We count only numbers: how many checks (by language, size and plan), how many registrations, how many different visitors a day. Different visitors are counted through a one-way hash of the address, the day and a secret key, deleted after two days. Addresses, texts and behaviour profiles are not stored. To prevent abuse the server briefly keeps the request rate per address in memory.

Feedback: if you write to us through the form, we keep your message and the contact you gave, so that we can reply. Do not put passwords or other people's personal data in a message.

06/Cookies and local storage

The site uses only what is technically necessary. The cookie sid appears after sign-in: a signed session, HttpOnly, valid for 12 hours, needed for the account to work. The browser's localStorage holds your preferences: theme, interface language, disabled analysis signals and a mark that the feedback form was already sent. None of it is used for advertising or tracking, so no consent banner is needed. You can clear all of it in your browser settings.

07/Your rights

Under the GDPR you can ask for access to your data, correction, erasure, object to processing and get a copy. Write to [email protected] from the address linked to the account. If you think we violate your rights, you can complain to the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt).

Account data is kept while the account exists; after an erasure request we delete the account and the records tied to it.

08/Changes

If something about how the site works changes, we update this text and the date at the top. Applicable law: Portugal and EU law.