Nothing leaves your browser until you click Analyze. Detection runs entirely locally; a detected page produces metadata only (document type, title, detection signals) inside your browser. When you click Analyze, the extension sends the page's text as rendered in your browser, plus its URL, title, and document type, to the analysis service.
You can also ask for an audit of an agreement you have not opened — the “Terms” link next to a signup button, say. That sends the link's address and the text of the link, and no page content at all; the service then fetches that page itself and audits the public version of it. Nothing is sent until you ask for it, and nothing is sent about the links you don't ask about. The address of a page you never opened is a new thing for this service to learn about you, which is why it is stated here rather than left to be inferred.
The document's text as your browser rendered it is never stored — not in any form. It produces your answer and is then discarded. All that is kept of it is a SHA-256 hash, which is how the service recognises the same document when someone analyses it again. That is the whole of what survives an analysis of a page you had open.
What is kept in full is the public copy of a document — the version the service fetched for itself, because you asked about a link you had not opened. It is read the way anyone not signed in would see it: no account, no cookies, no credentials of any kind. Every version of it is kept, too. When the service reads that address again and finds the wording has changed, the previous text stays alongside the new one rather than being overwritten.
Those two are treated differently because they are different things. Your render can carry your session — your name, your plan, your account page. A copy fetched with no credentials carries nobody's, and is the same document for everyone. The service keeps a pile of those to answer a question it otherwise cannot: whether a clause is one that every company has, or one somebody added on purpose. Answering that needs other companies' documents to compare against, and until now nothing kept any.
The analysis itself is kept, and so is the address of the document it read. Clicking Analyze writes up to four records, and these are all of them:
One more row exists outside that list, and only if you have touched the setting: your choice of whether to keep a history, stored against your account so the service can honour it.
Analyses are kept so the same document isn't audited from scratch every time someone opens it: a stored answer arrives immediately and costs you nothing against your daily limit. They are shared between users, under the following rules and no others.
The two never cross. Asking about a document you have open is answered from your own view of that document or not at all: you are never handed a copy of a page you are looking at that we read ourselves, because the audit is meant to judge what you were shown.
Four consequences of keeping analyses. None of them is a detail, so none of them is buried.
An analysis quotes your document word for word. The audit is only credible because it quotes: every item in it carries the load-bearing fragment it rests on, copied out of the document, and those fragments are stored with it. So “we keep the analysis, not the text” is not the clean split it sounds like. What is kept is a selection of the most consequential sentences on the page — and if that page was a logged-in view, those sentences came out of your session.
Nothing you can do keeps a document out of storage. The history setting stops the history, not the storage — that is why it is worded the way it is. It does not reach the public copy either: asking about a link is what causes the service to read that page and keep what it read. Deleting a history entry drops the link between you and the analysis; the analysis stays, unlinked, and can still be shown to someone whose browser renders the same document. Deleting your whole history, or one day your whole account, does the same thing at a larger scale — none of it reaches the stored analysis. The only control over whether a document is stored at all is not clicking Analyze.
The database links you to the documents you read. Your email is linked to your key, and your key is linked to the URLs in your history. That join did not exist before: usage records were deliberately built to count analyses without recording what they were. It exists now, by choice. It is a heavier thing to disclose than anything kept here previously, and a heavier thing to lose in a breach or hand over on request.
An analysis may be read editorially, and quoted in public. Stored analyses are reviewed by the people who run this site — in the dashboard, and through an editorial tool that an editor's own account authorises — looking for agreements worth writing about in the Hall of Shame. Analyses of pages nobody opened and analyses of what somebody's browser rendered are read alike; there is no separate pile. A page that results quotes the document, never your analysis, and every quoted clause is checked character-for-character against the public version of that document before anyone can read it. What that does not fence off is the prose around the quote: if your analysis described a signed-in or paywalled view, a detail only that view showed can reach a sentence a reader sees. A person reads every page before it is published — that is the control here, and it is the only one.
One residual we would rather state than round to zero. Turning your history off unlinks the URL from your key, but the stored analysis still carries a timestamp, so someone holding the whole database could line entries up against your usage records and often guess which were yours.
There used to be a second. A usage record also stored which of three reading “lenses” had read the document, and that lens was picked from the page's address — roughly one and a half bits derived from a URL, enough that someone already guessing a specific one could check their guess against a three-way bucket. The three lenses turned out to make no difference anybody could perceive, so they were deleted, and the column went with them. Nothing derived from the address of a page you read is recorded against your key any more.
Signing up stores your email address and a hash of your API key. Your key is shown to you once and cannot be read back — not even by us. You can regenerate it at any time, which immediately revokes the old one.
There is one analysis service and this page describes it, so everything above applies to every audit you ask for — there is no configuration of ours under which some other promise is the true one. The extension's options page carries a field for the service's address because the people building it run a copy on their own machines. Pointed anywhere but here, nothing on this page is a promise anybody has made you.