Nothing leaves your browser until you click Analyze. Detection runs entirely locally; a detected page produces metadata only (document type, title, detection signals) inside your browser. When you click Analyze, the extension sends the page's text as rendered in your browser, plus its URL, title, and document type, to the analysis service.
You can also ask for an audit of an agreement you have not opened — the “Terms” link next to a signup button, say. That sends the link's address and the text of the link, and no page content at all; the service then fetches that page itself and audits the public version of it. Nothing is sent until you ask for it, and nothing is sent about the links you don't ask about. The address of a page you never opened is a new thing for this service to learn about you, which is why it is stated here rather than left to be inferred.
The document's text is never stored — not in any form, not from any source. It produces your answer and is then discarded. All that is kept of it is a SHA-256 hash, which is how the service recognises the same document when someone analyses it again.
The analysis itself is kept, and so is the address of the document it read. Clicking Analyze writes up to three records, and these are all of them:
One more row exists outside that list, and only if you have touched the setting: your choice of whether to keep a history, stored against your account so the service can honour it.
Analyses are kept so the same document isn't audited from scratch every time someone opens it: a stored answer arrives immediately and costs you nothing against your daily limit. They are shared between users, under the following rules and no others.
The two never cross. Asking about a document you have open is answered from your own view of that document or not at all: you are never handed a copy of a page you are looking at that we read ourselves, because the audit is meant to judge what you were shown.
Three consequences of keeping analyses. None of them is a detail, so none of them is buried.
An analysis quotes your document word for word. The audit is only credible because it quotes: every finding that turns on specific wording pulls the phrase out inline, in quotation marks, with the section number. So “we keep the analysis, not the text” is not the clean split it sounds like. What is kept is a selection of the most consequential sentences on the page — and if that page was a logged-in view, those sentences came out of your session.
Nothing you can do keeps a document out of storage. The history setting stops the history, not the storage — that is why it is worded the way it is. Deleting a history entry drops the link between you and the analysis; the analysis stays, unlinked, and can still be shown to someone whose browser renders the same document. Deleting your whole history, or one day your whole account, does the same thing at a larger scale — none of it reaches the stored analysis. The only control over whether a document is stored at all is not clicking Analyze.
The database links you to the documents you read. Your email is linked to your key, and your key is linked to the URLs in your history. That join did not exist before: usage records were deliberately built to count analyses without recording what they were. It exists now, by choice. It is a heavier thing to disclose than anything kept here previously, and a heavier thing to lose in a breach or hand over on request.
Two residuals we would rather state than round to zero. Turning your history off unlinks the URL from your key, but the stored analysis still carries a timestamp, so someone holding the whole database could line entries up against your usage records and often guess which were yours. And the lens recorded on a usage record is picked from the page's URL, so it is roughly one and a half bits derived from it — not enough to reconstruct a URL, but enough that someone already guessing a specific one could check their guess against a three-way bucket.
Signing up stores your email address and a hash of your API key. Your key is shown to you once and cannot be read back — not even by us. You can regenerate it at any time, which immediately revokes the old one.
If you point the extension at your own server, your page text never transits the hosted service at all, and nothing on this page describes what happens to it — that is between you and whoever runs that server, which is probably you. A self-hosted server has nowhere to keep analyses unless its operator configures a database for them; the extension hides the history setting entirely for a service that reports it keeps nothing.