Privacy

What we hold

• Your Google account name, email address and profile picture — that is the whole of the sign-in. We never see your Google password.
• The projects, documents and links you upload.
• Which codes you have redeemed and which pages that unlocked.
• Your token balance and the ledger of every movement in it.
• The reports you commissioned and any follow-up conversation about them.

Who else sees it

Google (sign-in, hosting and analytics), Anthropic (the model that writes the reports — the document you asked to have read is sent with the request), Stripe (payments; we never see your card), and YouTube's public API, which we only ask for the public view count of videos you linked yourself.

Your script and the AI model

When you commission a report, the document you asked to have read is sent to Anthropic's API, which is the model that writes it. That is the only time it leaves our systems, and it only happens because you pressed the button.

Anthropic's Commercial Terms of Service say, in Section B: “Anthropic may not train models on Customer Content from Services.” That is a contractual term of our API agreement, not a policy statement, and you can read it yourself at the link rather than taking our word for it. Note it is the commercial terms that apply here — the consumer terms for Claude.ai are different, which is a common source of confusion.

Retention. Anthropic deletes API inputs and outputs within 30 days by default, so a copy of your pages exists on their systems for up to a month after a report runs. The exceptions are content their automated safety classifiers flag, which can be retained longer for review, and anything they are legally required to keep. We do not currently hold a zero-retention agreement with them; if that matters for your project, it is worth knowing before you upload.

We do not train anything on your work either — we do not train models at all.

Analytics

We use Google Analytics, through Firebase, to count page views and see which parts of the site people actually use. It sets cookies in your browser and Google receives your IP address and a randomly generated visitor id. We do not send it your name, your email, or anything about the projects you read or upload, and we never join analytics data to your account.

None of it runs until you say yes. The analytics code is not loaded, and no analytics cookie is set, unless you press Accept on the banner — pressing Reject means the script is never fetched at all, rather than fetched and told to behave. Signing in and reading pages work identically either way.

You can change your mind whenever you like: Cookies in the footer re-opens that banner. Switching from Accept to Reject stops collection immediately and deletes the analytics cookies rather than waiting for them to expire. The one cookie that is always set is your login session, which is strictly necessary to keep you signed in and holds nothing else.

Who can read your script

On a draft project, only you. Once published, any signed-in visitor can read the free pages you set, and anyone holding one of your access codes can read as far as that code grants. Locked pages are never sent to a browser at all — they are cut off on the server, not hidden with styling.

Deleting things

Unpublishing a project takes it off the site immediately. To delete an account and everything in it, get in touch and we will do it by hand — Slop2Nuts is small enough that this is a real person, not a queue.