The short version
| Question | Answer |
|---|---|
| Is my file uploaded? | No. PDF, Word and photo reading (including OCR) runs inside your browser. |
| What leaves my device? | Only the extracted text, after automatic redaction, over an encrypted (TLS) connection. |
| Do you store the text or the report? | No. Not in a database, not in logs, not in backups, not in emails. |
| Who else sees the text? | Google's Gemini API processes it to produce the report, under paid-tier terms that exclude using it to train models. |
| Do you use ads or tracking? | No. No ad networks, no analytics cookies, no tracking pixels, no fingerprinting. |
| What do you keep about me? | If you buy: your email, credit balance and purchase record. Never card details. |
Step by step: the life of your contract
1. Reading the file — on your device
When you choose a file, your browser opens it locally. PDFs are read with an in-browser PDF engine, Word files are converted in the browser, and photos or scanned pages are recognized with in-browser OCR. The file bytes are never sent to any server. Your browser's network panel will show no upload.
2. Redaction — on your device
Before anything is sent, the text is checked for email addresses, phone numbers, web links, IBANs, card numbers, social-security-style numbers and any run of 7 or more digits. Each match is replaced with a placeholder like [EMAIL] or [NUMBER], and the page shows you the count. Names are not detected automatically; you can remove them in the text box first. You can also switch redaction off if you need the model to see, for example, a specific account reference.
3. Transmission — encrypted
The redacted text goes over HTTPS to our server, which runs on Cloudflare's edge network. The request contains the text, your chosen language and whether this is a preview or a full report. It does not contain the file name.
4. Analysis — processed, not stored
Our server forwards the text to Google's Gemini API using our own key (which never reaches your browser) and returns the model's structured answer to you. Our server does not write the text or the report anywhere. The only records it keeps are: a daily, salted hash of your IP address (for rate limiting — it cannot be reversed and changes every day), the kind of scan, the language, and token counts for billing.
Google's paid API terms state that inputs are not used to improve their models. Google may retain inputs briefly for abuse monitoring under its policies; see Google's Gemini API terms. We do not use the free tier, where terms differ.
5. The report — yours alone
The report exists in your browser. Your last five full reports are also kept in your browser's own storage on your device for 7 days, and nowhere else, so an accidental close does not lose it; delete it from the scan page any time. Save it as a PDF to keep it longer. We cannot retrieve it for you, because we never had it.
What we store, and why
- If you only use the free preview: nothing about you, beyond the daily anonymous rate-limit counter.
- If you sign in or buy credits: your email address, your credit balance, purchase records (our reference, number of reports, amount, the PayPal payment ID), and sign-in sessions. Card details are handled entirely by PayPal; we never see or store them.
- If you contact us: your message, so we can answer it.
You can ask us to delete your account data at any time by emailing privacy@contractscanner.app.
Cookies
One cookie, cs_session, is set only after you sign in. It is HttpOnly, Secure and expires after 90 days or when you sign out. There are no advertising, analytics or third-party cookies. We don't need a cookie banner because we don't set anything that requires consent.
Technical safeguards
- HTTPS everywhere with HSTS; strict Content-Security-Policy; no third-party scripts except the open-source PDF, Word and OCR libraries loaded from a CDN for on-device processing.
- The AI API key is stored as an encrypted secret on the server and is never exposed to the browser.
- Passwordless sign-in: one-time email links that expire in 20 minutes, so there is no password to steal.
- Daily limits on scans to prevent abuse.
- Payments by PayPal, a PCI-DSS Level 1 certified provider, on its own hosted checkout page. Card data never touches our systems.
What we can't promise
No system is perfect. The transmission to the AI provider is a necessary step — a report of this quality cannot be produced on a phone alone yet. If a document is so sensitive that it must never leave your device, don't scan it; read it with a lawyer instead. If you spot a security problem, please tell us at privacy@contractscanner.app and we will respond quickly.
Full details are in the privacy policy.