What is stored and what is not

About this translation

This is a translation provided for convenience. The Spanish version is the legally binding one; in the event of any discrepancy, the Spanish text prevails.

What data is processed

Only what is needed for you to have an account and see your own history. There is no profiling, no advertising and no selling data to third parties.

• ·Email address and, if you provide it, your name. Collected when you create the account.
• ·Metrics for each optimization: level used, model chosen, and token count before and after.
• ·A 120-character preview of the optimized text, so you can recognise each entry in your history.
• ·The SHA-256 hash of your API keys. The key itself is never stored: if you lose it, there is no way to recover it, not even from our side.
• ·A monthly call counter per API key. It is informational (so you can see your own usage and so we can size the service) and imposes no limit.
• ·If you take out a paid plan: the customer and subscription identifiers Stripe assigns, their status and the renewal date. Your card details never reach our servers.

What is NOT processed

The full text of your prompts is not stored. The optimization engine is rules and dictionaries running in your own browser, so what you write does not leave your device.

The only exception is voluntary and explicit: if you press «verify» to get the exact token count, that text is sent to the counting service for that single purpose and is not stored.

No analytics, advertising or third-party cookies are used either.

Purpose and legal basis

Account and history data are processed to provide the service you requested: the legal basis is performance of the contract (art. 6.1.b GDPR).

Sending text to the counting service on request is based on your consent, which you give by pressing the button and can withhold simply by not pressing it.

How long it is kept

For as long as the account exists. When you delete it, the history, keys and profile are removed in cascade immediately, and no copies remain in the database.

Infrastructure backups may retain the information for a few more days before rotating, as part of the provider's normal operation.

Who else sees it

Only the providers strictly necessary for the service to work, each with access solely to what concerns them:

• ·Supabase (Supabase Inc.): accounts, authentication and database. Project hosted in the Ireland region (EU).
• ·Vercel (Vercel Inc.): hosting and running the application. Server region: Paris (EU).
• ·Anthropic (Anthropic PBC, USA): only when you press «verify» to get the exact token count. This involves an international transfer covered by the standard contractual clauses.
• ·Google (Google Ireland Ltd.): only if you sign in with «Continue with Google», and limited to validating your identity.
• ·Stripe (Stripe Payments Europe Ltd., Ireland): only if you take out a paid plan. It processes your payment and billing data as an independent controller.
• ·Resend (Resend Inc., USA): sending the confirmation and password recovery emails. This involves an international transfer covered by the standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time.

Erasure does not require writing to anyone: it is in Settings → Delete account, and it is immediate and irreversible. For the rest, write to the contact address.

If you believe the processing does not comply with the rules, you can complain to the Spanish Data Protection Agency (aepd.es).

Cookies and local storage

Technical session cookies are used, managed by Supabase, whose only function is to keep you signed in between pages. They are essential for the account to work and there is no way to opt out of them while staying signed in.

Preferences are also kept in your browser's local storage: the visual theme and, if you have no account, your history. That information never travels to any server.