Privacy policy.

1Introduction

GPTCleanup (“we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data. This policy explains what we collect, why we collect it, who we share it with, and what you can do about it.

It applies to everything at gptcleanup.com: the public site, the text scanner available to visitors without an account, the dashboard you reach after signing in, and the GPTCleanup Chrome extension.

This policy applies worldwide, including the European Economic Area, the United Kingdom, and the United States. We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2Chrome extension

The extension reads text you select and explicitly send through its context menu, or text you paste into its side panel. It does not collect your browsing history or continuously read pages. Replacing a selection requires your action and temporary access to the active tab.

Clean and Format process text locally in your browser. Review and Humanize send the submitted text to GPTCleanup and the processing providers described below after you consent. Submitted text may contain personal communications or other personal information, depending on what you choose to send. Extension Humanize results are not automatically saved as dashboard documents.

Sign-in uses your existing GPTCleanup account and Supabase authentication. Authentication tokens are stored in extension storage, accessible to trusted extension components, so you can remain signed in. Drafts are held in browser session storage. Signing out clears the extension session and drafts; removing the extension removes its local storage.

We process account email, subscription status, word balances, request identifiers, word counts, timestamps, and security metadata to authenticate requests, prevent duplicate charges and abuse, and apply the same account allowances as the website. Payments are handled by Stripe on the website; the extension does not read payment card fields. The sharing, retention and privacy rights described in this policy also apply to extension data.

3Data controller

GPTCleanup is the data controller responsible for your personal information. For GDPR or other privacy enquiries, contact privacy@gptcleanup.com.

4Information we collect

Information you give us

• Account information. Your email address and a hashed password. We never store your password in a readable form.
• Payment information. Handled entirely by Stripe. We never see or store your card number.
• Text you submit. The drafts you scan or rewrite.
• Messages. Emails and support requests you send us.

Information collected automatically

• Usage data. Pages viewed, features used, word counts, and session timestamps.
• Device information. Browser type, operating system, and IP address.
• Cookies. Essential authentication cookies. See our cookie policy.

Scanning without an account

You can scan a draft without signing up. When you do, we do not store the text. It is sent to our analysis provider, the findings are returned to your browser, and nothing is written to our database.

We do record a count of how many scans have come from your IP address that day, so that the free allowance cannot be used without limit. That counter holds your IP address and a number, nothing else, and it is deleted automatically twenty four hours after the first scan of the day.

5Legal basis for processing (GDPR)

• Contract performance. To provide the service you signed up for.
• Legitimate interests. To improve the product, prevent fraud and abuse, and keep the service secure. The scan counter described above rests on this basis.
• Consent. For marketing emails. You may withdraw consent at any time.
• Legal obligation. To comply with applicable law, including tax record keeping.

6How we use your information

• To provide and maintain the service
• To process payments and manage subscriptions
• To count usage against your plan allowance
• To send transactional email such as receipts and password resets
• To send marketing email, only where you have consented
• To detect and address technical faults, fraud, and abuse
• To improve the product and the experience of using it
• To comply with our legal obligations

7Third parties who process your data

We share data with the following processors, each contractually bound to protect it. We do not sell your personal data, and we never have.

• Supabase — database and authentication (USA)
• Stripe — payment processing (USA)
• OpenRouter — routes each AI request to one of the providers below (USA)
• Groq, Cerebras, Parasail and DeepInfra — AI processing for scanning and rewriting, reached through OpenRouter (USA)
• OpenAI — AI processing for scans in the dashboard, reached through OpenRouter (USA)
• Mistral — AI processing for rewriting when the providers above are unavailable, reached through OpenRouter (EU)
• Google — AI processing, used as a fallback when our primary provider is unavailable (USA)
• Vercel — application hosting (USA and global edge)
• Upstash — the short lived scan counter described above (global edge)
• Resend — email delivery (USA and EU)
• Sentry — error monitoring, which may capture your account identifier and IP address when something goes wrong (USA)

Text you submit is sent to our AI processors to be scanned or rewritten. It is not used to train their models.

8International data transfers

Your data may be transferred to and processed in the United States and other countries. For users in the EEA and the UK, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection.

9How long we keep it

• Account data. Kept while your account is active.
• Saved documents and rewrites. Kept until you delete them or close your account.
• Text scanned without an account. Not kept at all.
• The scan counter. Deleted automatically after twenty four hours.
• Payment records. Kept as required by tax law, typically seven years.

10Security

• All data is transmitted over HTTPS with TLS encryption
• Passwords are hashed using industry standard algorithms
• Database access is protected by row level security, so one account cannot read another’s data
• We monitor for errors and unusual activity

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You use the service at your own risk.

11Your rights

Under GDPR, CCPA, and comparable laws you have the right to:

• Access a copy of your personal data
• Correct data that is inaccurate
• Delete your data, sometimes called the right to be forgotten
• Port your data, receiving it in a machine readable format
• Restrict how we process your data
• Object to processing based on legitimate interests
• Withdraw consent to marketing at any time

12Exporting and deleting your account

You do not need to email us to exercise the two rights people use most. Both are available in your dashboard settings and take effect immediately.

• Export. Downloads everything we hold about you as a single JSON file: your profile, your saved documents, and your rewrite history.
• Delete. Removes your account, your profile, your saved documents, and your rewrite history. You are asked to type your email address to confirm, because it cannot be undone.

If you would rather we did it for you, email privacy@gptcleanup.com from the address on your account with the subject line “Account Deletion Request”. We will verify your identity first, and complete the request within thirty days as GDPR requires.

Deleting your account does not automatically cancel a paid subscription. Cancel it from the billing portal in your dashboard first, or contact us and we will handle both together.

We may retain limited data after deletion where the law requires it, such as payment records kept for tax purposes, or where there is an ongoing legal dispute.

13Cookies and tracking

We use essential cookies for authentication. They keep you signed in and cannot be disabled without breaking the service. We do not use advertising cookies and we do not sell your data to advertisers.

Our cookie policy sets out the detail.

14Children’s privacy

GPTCleanup is not intended for users under 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, contact privacy@gptcleanup.com and we will remove it.

15Changes to this policy

We may update this policy from time to time. Where a change is material we will notify account holders by email or in the app at least fourteen days before it takes effect. Otherwise we will post the updated policy here and change the date at the top. Continuing to use the service after a change means you accept it.

16Brand names and affiliation

Any brand names, trademarks, service marks, company names, product names, and logos mentioned on this site are referred to solely for descriptive and informational purposes. Such mentions do not indicate endorsement, affiliation, sponsorship, partnership, or approval by the owners of those names.

GPTCleanup is not affiliated with, endorsed by, sponsored by, partnered with, or associated with any of the brands, companies, or services mentioned on this site. All such names remain the exclusive property of their respective owners, and we make no claim of ownership over any of them.