How we handle your file
The short version: we keep nothing, but Google sees the document.
What we keep
- Nothing. There is no database and no account.
- Your file is held in memory while it is being reviewed, then discarded. Results exist only in your browser tab, so download them before you leave.
- Our logs record which step ran, how long it took and whether it failed. They never record the document’s text, its file name or the product name.
- There are no analytics, tracking cookies or session recordings.
Who else sees it
- Google. The file is sent to Google’s Gemini API on its free tier. Under those terms Google may use it to improve its products, and human reviewers may read it. We ask Google not to store the request.
- Tavily. If you search by name, the product and vendor names you type are sent to the Tavily search service. It never receives a document.
- Upstash. To keep the free quota fair we count reviews per visitor. The counter is keyed on a scrambled form of your IP address that changes daily, and it expires each day.
- The vendor’s website. If you search or paste a link, our server downloads the document you chose from the vendor’s site.
If you use your own AI key
- You can run reviews on your own Google Gemini, OpenAI or Anthropic Claude key instead of the shared free service. The review is then billed to your account with that provider, and the document goes to that provider under your account’s data terms.
- Your key is kept in the memory of your browser tab. It is not written to cookies or browser storage, and closing or reloading the tab forgets it.
- The key is sent to our server over an encrypted connection with each review, used for that one request, and discarded. We never save it and never write it to our logs.
- Use a key you can revoke. If you have any doubt, delete the key at the provider when you are done.
What that means for you
Only use this tool with VPATs the vendor has published. Do not upload confidential documents, or one a vendor sent you under a non-disclosure agreement.