Privacy policy

This policy covers NeverPrompted at www.neverprompted.com, operated by Max Beech (“we”, “us”). It does not cover Learnaway, a separate product for screening someone else's writing rather than your own; see that product's own policy for how it handles the documents people upload to it.

The free checker at /check, the free rewriter at /rewrite, and the calibrator all download the detection or rewrite engine to your browser and run entirely there. Your document is measured or rewritten on your own device and never transmitted to us, on any tier. You can confirm this yourself by opening your browser's network tab while a check or rewrite runs. We do not receive, log, or retain the text of documents processed this way, because we never see them in the first place.

Creating an account (email and password, or an OAuth provider) stores:

• Your email address and, if you gave one, a display name.
• A session token, the IP address and user-agent string of each sign-in, used to keep you signed in and to detect suspicious activity.
• Your plan (free or Pro) and, once you subscribe, a Stripe customer ID linking your account to your subscription.

Creating an API key for the JSON API or the hosted MCP mode stores a label and a SHA-256 hash of the key, plus when it was created, last used, and revoked. The key itself is shown once at creation and cannot be recovered or shown again, by you or by us, so a database disclosure would not hand over a working credential.

A check made through the JSON API or the hosted MCP mode (i.e. with WATERMARKREMOVERPRO_API_KEY set) necessarily runs on our servers, because a programmatic caller has no browser to run the on-device engine in. We record the word count, the billable units, and a SHA-256 hash of the document (not the document itself) against your account, purely to meter usage and enforce plan limits. The reduce_ai_evidence and calibrate_text rewrite tools have no server-side mode at all, on any tier: they always run in the calling process, never on our infrastructure.

Saved checks (visible on your dashboard) and PDF evidence reports are different: generating one stores the full analysis result against your account, including the text of the passages that were tested, so the report you download later matches the numbers you originally saw rather than a fresh re-run that might differ. This is the one place we retain excerpts of your document text server-side, and it only happens when you explicitly request a saved check or a report. Email hello@neverprompted.com to have any saved check deleted.

Subscription payments are handled entirely by Stripe. We never receive or store your card details: only a Stripe customer ID and your subscription status, used to keep your account's plan in sync with what you're paying for. See Stripe's own privacy policy for how it handles payment data.

Account and billing emails (password resets, receipts) are sent through our own transactional email provider on request. If that provider isn't configured on a given deployment, the email is not sent and nothing is silently faked; the affected flow (for example, password reset) fails visibly server-side rather than pretending to have worked.

We use Sentry to catch crashes and server errors so we can fix them. It is configured with default personal data collection switched off (sendDefaultPii: false), so it is not intended to capture your document text, email, or IP address as a matter of course; an error report may still incidentally include technical context such as a request path or a stack trace.

Only the processors needed to run the service itself:

• Neon (Postgres database hosting) for account, API key and saved-check data.
• Stripe for payment processing and subscription status.
• Our transactional email provider, for account and billing email, when configured.
• Sentry, for error monitoring.
• Vercel, for hosting and CDN delivery.

We do not sell personal data, and we do not use it for advertising.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. There is currently no self-service account-deletion button; email hello@neverprompted.com from the address on the account and we will delete the account and associated saved checks. API usage records (word counts and billable units, not document content) may be retained for a reasonable period afterwards for billing and fraud-prevention records.

We are based in the United Kingdom. Our infrastructure providers (Neon, Stripe, Sentry, Vercel) may process data in the UK, the EU, and the United States under their own standard safeguards.

If this policy changes materially, we'll update the date at the top of this page. We won't use a material change to justify handling previously collected data in a way you didn't agree to.

Questions, deletion requests, or anything else: hello@neverprompted.com.