Privacy Policy

markhuman.ai is operated by MiddleMatch OÜ, registered in Estonia. For the purposes of the EU General Data Protection Regulation, MiddleMatch OÜ is the data controller for the personal data described in this policy.

We have not appointed a Data Protection Officer. Given what we hold — no special categories, no profiling, no monitoring at scale — one is not required, and writing to the address above reaches the people who actually run the service.

When you run a scan, your text is sent from your browser to our server, and from there to our detection service over an encrypted connection. The service returns a score; the score and your own text are sent straight back to your browser to draw the report. Nothing about the text is written to disk on our side.

Sentence-level highlighting works by scoring each sentence in the same pass. That means individual sentences are also sent to the detection service. They are handled exactly the same way — scored and discarded.

We do not use submitted text to train, tune, or evaluate any model. We do not read it, sell it, or hand it to anyone for their own purposes. If the detection service is unreachable or returns an error, we log the error and the service’s response — never the text you submitted.

The detection service is our own, not a third party’s. It scores your text in memory and writes no part of it to a log or to disk; the only thing its access log records is that a request happened, with the status and how long it took.

You can use the free detector without an account. If you create one, we store your email address, a hashed and salted version of your password (never the password itself), your plan, your word allowance and how much of it you have used, and the date the account was created.

If you sign in with Google instead, we store your email address and the Google account identifier so we can recognise you next time. That is all we ask Google for — we do not request your name or profile picture, and we never receive your Google password.

Signing in creates a session record — a random token, the account it belongs to, and an expiry date — so you stay signed in between visits.

Payments are processed by Stripe. Card numbers, billing addresses, and any other payment details are entered on Stripe’s own hosted checkout and billing pages. They never pass through, and are never stored on, our servers.

What we store is the Stripe customer and subscription identifiers linked to your account, so we know which plan you are on and when to reset your allowance. We send Stripe your email address when your customer record is first created, and Stripe sends your receipts. Stripe’s handling of your payment data is governed by its own privacy policy.

The free tier allows 50 scans per browser per day, resetting at midnight UTC. To count them, the first scan from a browser is issued a random identifier in a cookie. That identifier is not linked to your name, email, or account — it is a counter key and nothing else.

A second, much looser daily ceiling is applied per network, to stop one person clearing cookies from consuming the free tier. To do this we take the IP address of the request, hash it, and count against the hash. The raw IP address is never stored. Both counters live only in the server’s memory: they reset every day, and they are wiped entirely whenever the service restarts or is redeployed.

Like any web service, our hosting provider processes the network requests needed to serve pages to you. Application error logs record what went wrong — status codes and error messages — not the content you submitted.

Concretely: the website runs on Railway, and the connection to our detection service is carried over Cloudflare. Both keep network-level access logs — timestamps, IP addresses, request lines — under their own retention rules, in the ordinary course of delivering traffic. That is infrastructure logging, not something we collect or can read the contents of.

Every cookie this site sets is functional — it makes a feature work. There are no advertising cookies and no cross-site tracking cookies. All three are HTTP-only, meaning page scripts cannot read them.

Clearing your cookies signs you out and resets your free daily scan counter. Nothing else on the site depends on them.

There is no Google Analytics on this site. No Tag Manager, no Meta pixel, no session recording, no heatmaps, no A/B testing script, no advertising network, and no third-party analytics of any kind. We do not build a profile of you, and we do not have anything to sell to a data broker even if we wanted to.

This is why you are not being shown a cookie consent banner. The only cookies in play are the three functional ones listed above, and there is no tracking to opt out of.

We do not sell your data and we do not share it for advertising. Data reaches other parties only where the product cannot work otherwise:

We may also disclose information where we are legally required to. Given what we hold, that would amount to account and billing records — the text you scanned no longer exists to disclose.

There is currently no self-serve delete button for accounts. To have your account and its records removed, email us at support@markhuman.ai and we will do it. Billing records held by Stripe are subject to Stripe’s own retention rules and any records we are required to keep for tax and accounting purposes.

You can use the detector without giving us anything: no account, no email, no card, up to 50 scans a day of up to 2,500 words each.

If you do have an account, you can ask us for a copy of what we hold on you, ask us to correct it, or ask us to delete it, by emailing support@markhuman.ai. You can cancel a subscription at any time through the billing portal linked from your account menu.

MiddleMatch OÜ is established in Estonia, so the EU General Data Protection Regulation applies to how we handle personal data. We rely on these bases:

You have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on legitimate interests, you can object and we will stop unless we have grounds that override yours. Email support@markhuman.ai from the address on the account and we will action it within one month. Exercising any of these costs nothing.

Some of the services we depend on — Stripe, Google sign-in, and our hosting providers — operate outside the European Economic Area. Where personal data reaches them, it is transferred under the European Commission’s Standard Contractual Clauses or an adequacy decision, as set out in each provider’s own data processing terms. The text you scan is not part of this: it goes to our own detection service and nowhere else.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), and you may also complain to the authority where you live.

For readers in California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have no advertising or cross-context behavioural tracking to opt out of. The access and deletion rights above are available to you on the same terms.

Passwords are stored only as salted scrypt hashes and compared in constant time. Session tokens are random 32-byte values. Cookies are HTTP-only and marked Secure over HTTPS. The credential used to reach the detection service stays on the server and is never exposed to your browser.

No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, please tell us at support@markhuman.ai before disclosing it publicly.

If we change what we collect or how we handle it, we will update this page and move the “last updated” date at the top. Material changes to how we treat text you have already submitted are not possible — we do not have it.

Questions about this policy, or about the data we hold on you: support@markhuman.ai. See also our Terms of Service and the contact page.