Privacy policy

This policy covers writtencheck.com. We've kept it plain because we collect very little.

The short version

• The text you check is used to make your result and then thrown away. We don't store it, share it or train on it.
• We don't use advertising or ad tracking. If you agree, we use Google Analytics to see how the site is used. If you don't, no analytics cookies are set.
• We keep short-lived, scrambled records to stop abuse, and simple page view counts that can't be linked to you.
• If you leave a blog comment, we keep what you send so we can show it.
• If you write a review, we show your stars and words publicly with your first name, the first letter of your last name and your profile photo. Your email is never shown.
• For each check we keep a small record without the text: where it came from, the country, the language, the word count, the score and which detector answered. This shows us how the detector is used and whether it works.
• Accounts are optional. You only need one for an API key or for the private document vault. Documents in the vault are encrypted in your browser with a password only you know, so we can't read them.
• If you report a wrong result on the website or in our Android app, we keep your name, email and report so we can reply. Your text is included only if you choose to attach it.

Who we are

WrittenCheck is an independent project run by a small team in Pakistan. We decide how the data described here is used. You can contact us at writtenchecksupport@gmail.com.

The text you check

When you press "Check text", your text is sent over an encrypted connection (HTTPS) to our server. Text sent to the detector passes through Cloudflare, our network provider, on its way to our own server. It isn't stored. The detector reads it in memory and sends back the result. When the check ends, the text is discarded. We don't save it to a file, a database or a log, and we don't use it to train the detector. Apart from Cloudflare carrying it, we don't send your text to any other company or AI service. The one exception is a wrong-result report where you tick "Include my text", described below.

If you upload a file, your browser reads the file on your own device and only the text inside it is sent for checking. The file itself never reaches us.

If you paste with the Paste button, your browser may ask for permission to read your clipboard. That check happens in your browser. We only receive what you then choose to check.

Limits on how often you can check

To keep the free tool fair, we count how many checks come from each connection. We don't store your IP address for this. We store a scrambled code made from your IP address and the date, which can't be turned back into the address and changes every day. Next to it we keep the number of checks and the times of your last few checks. These records are deleted after about two days.

Check records

Every time a check is made on our website, in the widget, through the API or in the Android app, we save one short record about it. It never contains the text. A record holds:

• the time, and whether the check came from the website, the widget, the API or the app
• the country, which our own server works out from your connection's IP address with an offline lookup table (IP Geolocation by DB-IP). Only the two-letter country code is kept, never the IP address
• the language, the word count, the score, the verdict and its confidence, which detector answered (our neural server or our rules engine), how long it took, and an error code if the check failed
• a scrambled code so we can tell new people from returning ones. For an API call this is the API key's number. For the app it is a scrambled form of the random install code. If you are signed in, it is your account number. If you accepted analytics cookies on the website, it is a scrambled form of a random ID kept in your browser (see "Cookies and local storage"). Otherwise it is a scrambled code made from your IP address, your browser's description (its user agent and languages) and the date. It changes every day, so it can't follow you from one day to the next, and it can't be turned back into the address or browser details, which we don't keep. If you accepted analytics cookies and later sign in on the same browser, the earlier records from that browser are linked to your account.

We use these records to count checks, see which languages and countries use the detector, watch error rates, and check how often our neural server answers. Signed-in users can see their own records on their account page. Records are deleted after about 13 months.

Accounts

You don't need an account to use the detector. You can create one if you want an API key or the private document vault.

• What we keep: your email address, the name you give (optional), the country you signed up from, when you joined and last signed in, and your account settings. If you sign in with Google, we also keep the ID Google gives your account. We never receive your Google password.
• Profile photo: if you sign in with Google, we copy your Google profile photo to our server once, as a small square image, so our pages never load it from Google. You can upload your own photo instead, or remove it, on your account page. Uploaded photos are cropped and re-saved by us, which removes any location or camera details in the file. Your photo shows to you in the site header and on your account page. Other people see it only next to a review you publish. It is deleted when you remove it or delete your account.
• Passwords are stored only as a slow, salted hash (Argon2id) with an extra secret key kept outside the website's files. We can't see your password.
• Email confirmation: if you sign up with email, we send a 6-digit code to confirm the address. We also email codes for password resets and tell you when your password changes. We don't send newsletters or marketing.
• Sessions: when you sign in, we keep a record of the session with your device type (such as "Chrome on Windows") and country, so you can see and end sessions on the Security page. Sessions end after 14 days without use.
• Account log: we keep a short log of events such as sign-ins, wrong passwords, and keys created or revoked, so you can spot anything strange.
• API keys are shown to you once. We keep only a fingerprint of each key, so we can check it but can't show it again.
• Google sign-in prompt: after you answer our cookie banner, pages may show Google's own "Sign in with Google" prompt once per visit if you are not signed in. To show it, your browser loads a script from Google, and Google may see that you visited our site, as with any Google sign-in button. We receive nothing unless you choose to continue, and then only your name, email address, photo and Google account ID.
• Deleting your account removes your profile, photo, review, sessions, keys, account log and every document in your vault right away. Check records lose the link to you and only count toward site totals.

Your private document vault

Signed-in users can keep documents in a vault. It is built so that we can't read what you store.

• You choose a vault password. Your browser uses it to lock a random key, and that key encrypts every document (AES-256-GCM) before anything leaves your device. Titles are encrypted too.
• Our server receives and stores only the encrypted data. We never receive your vault password, the key or the plain text, so we can't open your documents, and we couldn't hand them over in readable form.
• You also get a recovery key when you set up the vault. If you lose both the vault password and the recovery key, nobody can open the documents, including us.
• We know how many documents you have and how much space they use, so we can apply the storage limit.
• If you use "Check for AI" on a vault document, the text is sent to the detector like any other check, then thrown away.

The widget and the API

Other websites can add our detector as a widget, and developers can send text to our public API. Text checked this way is handled exactly like text checked on our own pages. It's read in memory, the result is sent back, and then the text is thrown away. We don't save it, log it or use it for training.

• Widget and API checks use the same kind of scrambled, daily rate-limit record described above, kept for about two days.
• Each widget and API check also gets the check record described above. We don't record which website a widget check came from.
• API keys belong to an account. If you use a key, its calls are linked to your account so you can see your usage and we can apply your daily limit.
• The widget sets no cookies, uses no browser storage and loads nothing from other companies. It doesn't load Google Analytics.
• A website that adds the widget can choose to receive results as an event. It then gets the score, range, confidence, verdict, word count and language, never the text.
• The website that shows the widget has its own privacy policy, which covers what that website does.

The Android app

Our Android app checks text with the same detector as this website. Text you check in the app is handled the same way. It goes to our server, passes through Cloudflare to our own detector server, is read in memory, and the result is sent back. Then the text is thrown away.

• The app saves your history only on your phone. You can turn it off or clear it in the app's settings.
• When the app first opens, our server gives it a random install code. The code isn't linked to your name, email or phone number. We use it only to count your free daily checks, with the same scrambled two-day records described above.
• If you tap "Wrong?" in the app, you can send us a wrong-result report, as described in the next section.

Reporting a wrong result

Under every result on our website, and in the Android app, you can tell us that a result looks wrong. Sending a report is up to you.

• A report includes your name and email address, your answer and note, and the result you got (score, verdict, language and word count).
• From the website, we also keep the page you were on and your browser and system type, such as "Chrome 129" and "Windows". From the app, we keep the app version, your Android version and your phone model.
• The text you checked is included only if you tick "Include my text". We use it only to look into your report and to test fixes to the detector. We don't publish it or share it.
• We use your name and email only to reply to you about the report. We don't add you to a mailing list.
• To stop spam, we count reports with the same scrambled two-day records described above.
• Reports are kept while we work on them and deleted 180 days after we close them. You can ask us to delete yours sooner.

Server logs

Our hosting provider, Hostinger, keeps standard web server logs, as almost every website does. These record things like your IP address, the page you asked for, the time and your browser type. They don't include the text you check, because it's sent in the body of the request and not in the address. When the detector is shown as a widget on another website, these logs may also record the address of that page, which your browser sends with the request. Hostinger keeps these logs for a limited time for security and to run the service, under its own privacy policy.

Page view counts

To see which pages people read, each page sends us a small count with only two things: the page's address and the website you came from, such as a search engine. We add these up per day. No cookie, no ID and no IP address is stored with them, so the counts can't be linked to you. If your browser sends a Do Not Track signal, nothing is counted.

Google Analytics

We use Google Analytics, a service from Google, to understand how people find and use WrittenCheck: which pages they visit, where they came from, and roughly which country and device they use. This helps us decide what to improve.

• Your choice comes first. The first time you visit, a banner asks whether you accept analytics cookies. Analytics cookies are only set if you press Accept. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.
• If you decline or haven't chosen yet, we use Google's Consent Mode. Google then receives only basic signals without cookies or identifiers, such as the page and the browser type, and it can't use them to recognise you on a later visit.
• What is sent: the page address, the site you came from, your browser and device type, an approximate location worked out from your IP address, and simple interactions such as scrolling and clicks on outside links. Google Analytics 4 doesn't log or store IP addresses.
• What is never sent: the text you check, uploaded files and your results. They aren't part of any page address or event.
• Settings we use: advertising features, Google signals and ad personalisation are turned off. Data is kept in Google Analytics for 14 months, and the analytics cookies last up to 13 months.

Google processes this data under its own terms and privacy policy. You can read how Google uses information from sites that use its services. You can also block Google Analytics on all websites with Google's opt-out browser add-on.

Cookies and local storage

Analytics cookies are only set if you accept them, as described above. Your choice itself is saved in your browser's local storage so the banner doesn't come back on every page. If you switch between light and dark mode, your browser remembers that in local storage too. If you sign in to an account, we set one sign-in cookie (__Host-wcs). It only works over HTTPS on writtencheck.com, can't be read by scripts, and lasts until you sign out or for up to 60 days. While you sign in with Google, a second short cookie (__Host-wcg) protects that step and is removed within 10 minutes. These cookies are needed for the account to work, so they don't depend on the analytics choice. If you accept analytics cookies, the website also keeps a random ID (wc-vid) in your browser's local storage, which lets our check records tell new visitors from returning ones. It is removed if you decline. People who write for our blog use a sign-in cookie in a private editing area that visitors never see. The cookie policy lists every item.

Our fonts and our own scripts are hosted on our own server. The only outside script on the site is the Google Analytics tag described above.

Blog comments

If you comment on a blog post, we store your name, your comment and your email address if you give one. Your email is never shown. To stop spam, we also keep a scrambled code made from your IP address and the month, which can't be turned back into the address. Every comment is checked by us before it appears. We keep comments while the article is online, unless you ask us to remove yours.

Reviews

You need an account to write a review. We store your star rating, your title and text, the country you wrote it from, whether you started from the prompt shown after a check, and when you wrote or changed it. Every new or changed review is read by us before it appears. We publish good and bad reviews alike and remove only spam, abuse, links and personal details. A published review shows your stars, title and text with your first name, the first letter of your last name and your profile photo. Your email address is never shown. When a review is published for the first time, we send you one email to say so. You can edit or delete your review on the reviews page at any time, and it is deleted with your account. We may reply to a review publicly.

Emails you send us

If you email us, we keep your message and address so we can reply and follow up. We use them only for that. We delete them when they're no longer needed, and you can ask us to delete them sooner.

How long we keep things

Why we use this data

We use the small amount of data above only to run the detector and website, keep them secure, stop abuse, show your comment and answer your messages. Where data protection laws such as the GDPR apply, our reasons are our legitimate interest in running a safe, working service, and your consent when you accept analytics cookies, post a comment or email us.

Who we share data with

We don't sell or rent data, and we don't share it with advertisers. Three outside companies are involved. Our hosting provider, Hostinger, runs the servers the site lives on and the mailbox we send account emails from. Cloudflare, our network provider, carries text sent to the detector to our own server and doesn't store it. Google provides Google Analytics as described above, and "Continue with Google" if you choose to sign in that way. We may disclose information if the law requires it, but because we don't store your text or IP address, there is very little we could hand over.

Our servers may be outside your country. When you use the site, the data above is processed where our host operates.

Security

All traffic to the site uses HTTPS. The detector processes text in memory and doesn't write it to disk. Account data is kept in a private folder outside the website's public files. Passwords, codes and API keys are stored only as hashes or fingerprints, settings secrets are encrypted, sign-ins are limited and locked after repeated wrong passwords, and vault documents are encrypted in your browser. Access to the editing area is protected by passkeys. No system is perfectly secure, but we keep what we hold to a minimum so there's little to lose.

Children

WrittenCheck is a general tool and isn't aimed at children under 13. Children under 13 shouldn't post blog comments or send us personal information. If you think a child has sent us personal data, email us and we'll delete it.

Your rights

Depending on where you live, you may have the right to ask what data we hold about you, to correct or delete it, or to object to how we use it. Because we don't keep your text or your IP address, there's usually nothing we can find. If you have an account, you can see your usage, sessions and account log, and delete everything, on your account page. For comments and emails, we can find, export or delete what you sent. Email writtenchecksupport@gmail.com with "Privacy" in the subject line. You also have the right to complain to your local data protection authority.

Ads in the future

We don't show ads today. If we add ads later, we'll update this page and the cookie policy before they go live and, where the law requires it, ask for your consent first.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. For big changes, we'll also note them on the site.

Contact

Email writtenchecksupport@gmail.com.