Your data
Your ChatGPT export is close to the most sensitive file you own. It is worth being exact about what happens to it, including the parts that are not flattering.
We do not claim "we keep nothing." That claim is almost always false, and it is false in an interesting way: a service with no database still leaves your data in payment records, in logs, and at every vendor it calls. What follows is the actual accounting.
Nothing leaves your machine until you have paid
When you choose your conversations.json, it is read in your browser. The parsing —
walking the conversation tree, counting sessions and messages, finding the date range —
happens locally in JavaScript. What gets sent to us at that point is six numbers: session
count, message count, character count, first date, last date, and how many sessions look
like fiction or testing.
That is enough to price the job and to tell you if your corpus is too large. It is not enough to tell us anything about you.
Your history uploads after the payment clears, and not before. If you look at the price and close the tab, we never had it.
Your export is encrypted before it is uploaded
When you order, your browser generates a key and shows it to you. You cannot choose it yourself, for two reasons: a password a person invents can be guessed offline against stored data at maybe 20–40 bits of strength, where this one is 100; and some people would reuse their email password, which would put a credential that unlocks their inbox into our memory. So we generate it, and you keep it.
Your browser then encrypts your export with that key, before uploading. What reaches our server is ciphertext. We store it that way.
We never receive the key except at one moment: when you authorise the analysis. It arrives in that single request, stays in memory for the run, and is gone when the run ends. It is never written to storage, never logged, and never returned.
This is not end-to-end encryption, and we will not call it that. The pipeline has to read your text to analyse it. What we can honestly claim is narrower and still worth having:
Ciphertext at rest, under a key we do not hold. Plaintext in memory only, and only during a run you authorised.
So a breach of our storage yields nothing readable. A subpoena served on stored data yields nothing readable. Nobody at this company, or at Railway, can browse your history. What remains exposed is the run itself, and the model providers described below — which is irreducible for a service that analyses text.
Three places to keep your key
Your password manager (the durable one — it syncs, so you can return on any device), this browser's local storage (convenience only; clearing site data wipes it), and a file you can download.
One honest note on the first: a password manager syncs your key to Apple's or Google's vault. Encrypted there, but no longer confined to one device. That is a real trade — more durable, slightly less private — and we think durability wins when losing the key means losing the report.
Because if you lose it, it is gone. Not recoverable by you, not recoverable by us. That is the same property that makes everything above true; it does not come for free.
Direct identifiers are removed before anything is sent to a model
Before any text leaves our server, a redaction pass replaces:
- full names you list for us
- email addresses
- phone numbers
- street addresses
with stable placeholders (<PERSON_1>, <EMAIL_1>) so the shape of a pattern survives but
the identifier does not. This covers conversation titles as well as message bodies —
ChatGPT writes titles from your content, so they leak names constantly, and titles travel
with every request.
This is best-effort and it is not a guarantee. It misses nicknames, employers, rare medical conditions, place names, and any third party you did not list. If your history contains something that would be damaging in a stranger's hands, assume redaction will not catch it, and decide accordingly.
What is kept, and for how long
| Thing | Where it lives | For how long |
|---|---|---|
| Your uploaded export | Encrypted, in the job store | Destroyed the moment your report is sealed or the order ends; 24 hours at the absolute latest |
| Your export in the clear | Server memory, during an authorised run only | Unreachable once the run returns |
| Your finished report | Encrypted, in the job store | Purged at 24 hours, collected or not |
| Your key | Only with you. Never stored, never logged. | We cannot recover it, ever. |
| Job metadata (status, size, timestamps) | The job store | Purged at 24 hours |
| Payment record | Stripe | Years. Required by tax and chargeback law. |
| Request metadata (IP, timing) | Cloudflare and Railway logs | Their retention, not ours |
The 24-hour purge is unconditional and runs whether or not you collected the report. If you want to keep it, download it.
Note the second row, because it is the honest one: there is a window, during the run you authorised, when your history exists in the clear in our server's memory. That is what analysing text requires. Everything else in this table is ciphertext.
Chat content never enters our logs
The log path strips message text, quotes, and conversation titles before writing anything. This is deliberate and it is the failure mode we watch hardest: a log line is the easiest way for private text to end up somewhere with a retention policy nobody chose.
Everyone who receives something
The list below is generated from the same constant the code uses. If a vendor is added to the pipeline and not to this list, that is a bug we want to be loud.
| Who | What they receive | Why | What limits it |
|---|---|---|---|
| OpenRouter | Redacted chat text and extracted markers | Routes every model call. One HTTP shape, no vendor SDKs. | Requests send provider.data_collection = "deny". |
| Model providers behind OpenRouter | The same redacted text, for the call they serve | Extraction, the absence pass, synthesis, and the adversarial review each run on a different model family. | Pinned zero-retention routing is a launch gate, not yet wired — reports are not on sale until it is. See the note on pinning below. |
| Safety panel providers | The finished report | Four independent judges check the report for diagnosis language, clinical register, and unsupported isolation claims before it reaches you. | More recipients than the pipeline itself. Named here because that is the point. |
| Stripe | Your email and payment details. Never your chat data. | Takes the payment. Card details go straight to Stripe and never touch our servers. | Stripe retains payment records for years for tax and chargeback law. We cannot delete this. |
| Railway | Encrypted job artifacts, for up to 24 hours | Runs the server. | Artifacts are encrypted with a key we do not store. Purged on a hard timer. |
| Cloudflare | Request metadata (IP, timing). Not request bodies at rest. | DNS and CDN in front of the origin. | Order and API routes are served no-store. |
The honest caveat about model providers
All model traffic routes through OpenRouter, and every request asks providers not to
collect data (data_collection: "deny" on the request itself).
Here is the part most services would not tell you: OpenRouter chooses which backend serves a given request. Unless the provider is explicitly pinned, the same model name can be served by a different company between one run and the next, under different retention terms, without any visible change. A service that says "we use zero-retention providers" without pinning is making a claim its code does not enforce.
We hold ourselves to that same standard, so here is our exact status: pinned, zero-retention routing is a launch gate, and it is not wired in yet. Reports are not on sale until it is. When it ships, this page will name the pinned providers, and the paragraph above will describe something enforced in code rather than promised in prose. As of today, no customer data has been through this pipeline — the only corpus analysed end to end is the author's own.
Two things we cannot fix
Stripe knows you bought this. Your email, your payment, and the fact that this particular purchase is associated with you sit in Stripe's records for years. That association is itself sensitive, and no design on our side makes it go away. If that matters to you, that is a legitimate reason not to buy.
OpenAI already has your chat history. They generated it. Nothing here changes that, and it is worth being clear that the exposure this service adds is at the analysis layer, not the original conversation.
Withdrawing
Before you pay: close the tab. We have nothing.
After you pay but before you start the analysis: write to [email protected] and we will cancel, destroy the encrypted upload, and refund you in full. (A self-serve cancel button is on the launch checklist; until it exists we would rather tell you the honest path than describe a control that is not there.)
Once a run is underway it cannot be stopped mid-flight — the model calls are already in progress — but the run's artifacts still purge on the same 24-hour deadline as everything else.
After the report is generated: it purges itself within 24 hours regardless, and you can purge it immediately from your job page.
We cannot delete your Stripe payment record, and we will not pretend otherwise.
Never for someone else
This is for analysing your own export. Do not buy it to analyse a partner's, a child's, an employee's, or a friend's chat history. That is a term of service, and it is also the thing most likely to cause real harm with this tool. See terms.