We read fine print for a living. Ours should be easy to check.

What we collect

When you choose Analyze this policy, we receive the page URL and the text of that policy. We do not receive your browsing history, pages you did not submit, passwords, or browser credentials.

Who you are to us

There is no Policy Pal account. On your first analysis, our server creates a random installation token and stores it in your browser. We keep only a one-way hash of the token. A subscription can link that installation to an opaque Stripe customer identifier.

To honour a cancellation even when it reaches us before an analysis starts, we briefly keep a random analysis identifier, its cancellation state, and the installation it belongs to. It contains no document or page address and is deleted after five minutes.

Where policy text goes

Our server sends the document text to one analysis provider, Google Gemini, and to no other. If it fails or cannot ground the report, the analysis fails and nothing is charged; there is no second provider. Provider retention settings are configured for our API account.

What we keep

We cache reports for published policies by document content. This lets another reader of the same public document get an instant result. The cached report contains the policy’s own text and analysis, not your identity.

We also keep a record of each published policy document we have read: its address, which kind of document it is, when we read it, and the answers we found. It lets us tell you how a term compares with other services, and tell you what changed when a company edits its policy. It is a record of public documents, not of people — no installation token, email, or network address is stored with it, and nothing in it says who asked.

Most of those documents we fetched ourselves, and nobody asked us to. Where a document entered that record because you analyzed it, the only thing added is that the document exists at that address and was read. We add it only if the address is a public https page, and we never publish it, re-read it on our own, or cite it to anyone until our server has fetched the same address itself with no login — so a page only you could see stays off our public report pages.

When we fetch a page ourselves

Our server reads published policy pages directly, both to build the record above and to answer questions from software calling our public interface. It identifies itself as PolicyPalBot, reads a site’s robots.txt first and does what it says, and reads one page at a time per site. It fetches only public httpsaddresses, and only ever the document asked for.

That interface has no account and is not connected to your installation. Software calling it is recognised across calls by a keyed hash of its network address, never the address itself, so that a first call can be free, and a prepaid balance is held by a keyed hash of a random balance key it is given, so that the balance survives its address changing. Neither identifies a person. A record with no balance expires 30 days after its last call, and the receipts after 90. While a call is running, a temporary reservation holds its place within the daily limit. It contains only those keyed hashes, an amount and timestamps; it expires after ten minutes, and an abandoned balance debit is returned.

Watching a policy

If you ask Policy Pal to watch a policy, we record which policy and which browser asked — nothing about you. It is how we can re-read that document and tell you when one of the eight standard answers moves. A list of the services somebody watches is the most sensitive thing we hold, so we hold as little of it as possible: the address is stored once, in our record of public documents, and your watch points at it.

A watch expires if you have not looked at it for 400 days, and it goes immediately when you choose Delete everything. A change we found is kept for 90 days, whether or not you read it. We tell you in the panel and with a count on the toolbar icon, and nowhere else: we do not email you about a change.

The full threat model is public, in docs/MONITORING.md in our repository.

A document you were sent

A lease, an offer, or an NDA is not published on a web page, and it is not public. When you choose a file, Policy Pal reads its text in your browser and sends only that text — the file itself never leaves your device. We read the text and keep the report — never the document itself — for 30 days, so you can reopen it without sending it again. Then it is deleted. Your browser does not keep an additional persistent copy of a private report.

It never touches the shared cache or the record of public documents. Those are keyed by content so that one reader's analysis can serve the next, which is exactly the wrong property for something that belongs to you: the same key would hand your lease to whoever next submitted the same words. Your documents are reachable only with your browser's installation token, and Delete everything removes them at once.

Email and payment

We keep an email only if you subscribe. Stripe provides it, and we use it only to let you restore the subscription in another browser. We store only a keyed hash of the normalized address. Amazon SES delivers the six-digit restore code. A one-off purchase, such as a pack of analyses or a balance for software you use, gives Stripe an email for its receipt, and we do not store it. Stripe processes payment details. Policy Pal does not receive your full card number.

Website and extension analytics

The Policy Pal website uses cookieless Google Analytics to count page visits, understand which campaigns bring people to the site, and measure clicks through to the browser store. Analytics storage, advertising storage, Google Signals, and ad personalisation are disabled. We send the page path and permitted campaign tags, but not policy text, email addresses, checkout details, or the pages you ask the extension to analyze.

The extension does not load third-party product analytics code. Its server reports first activation, successful analysis, checkout started, retained purchase, and subscription restored to a separate Google Analytics property, along with the fact that a subscription was offered and why. A random installation identifier groups repeat use. The event fields are limited to plan, cache status, the reason a subscription was offered, the billing interval, currency, published price, and an irreversible transaction deduplication value. We do not send policy text, evidence, page titles, visited URLs, email, restore codes, installation tokens, Stripe identifiers, or model requests and responses.

Operational logs

We keep short-lived operational logs for request status, timing, provider category, model token counts, and quote-verification rate. The logs do not contain policy text, URLs, evidence quotes, email addresses, restore codes, installation tokens, Stripe payloads, or model responses.

Sentry receives production error reports from the website, extension, and server. We remove page and request URLs, user fields, breadcrumbs, arbitrary context, local variables, and error messages before delivery. Reports retain the error type, code location, app release, browser target, and a bounded request reference where available. Firefox asks separately whether to allow this optional technical and interaction data; declining does not limit the extension.

Delete everything

The primary route is in the Policy Pal panel footer. Choose Delete everything and confirm. Policy Pal expires open checkouts, cancels incomplete subscriptions immediately, schedules every other live subscription to end after its paid period, then clears the installation token, usage, purchased credits, watches, pending changes, any documents you sent us, email hash, restore state, subscription link, and locally saved reports. Server-cached reports for published documents remain, as does the record of which public documents we have read, because neither contains anything about you. An unspent purchased credit is not refunded, which the pricing page says before you buy one.

You can also email privacy@policypal.link. If a subscription is involved, we will verify you through the restore-code flow before acting.

Security and processors

Cloudflare provides server functions and the D1 database. Stripe provides billing. Amazon SES delivers restore mail. Google provides cookieless website analytics and the bounded extension events described above. Sentry provides privacy-filtered error monitoring. Google Gemini provides the analysis.

Questions

Email privacy@policypal.link. We will update the date above when this policy changes.