Free AI detector privacy: there is no server to send anything to.

1. Who we are and scope of this policy

This Privacy Policy governs the operation of AI Detector by Ceptile (accessible at aidetector.ceptile.com, referred to herein as the “Service”, “Application”, or “Platform”). The Service is owned, developed, and operated by Ceptile (ceptile.com), an AI research and conversational intelligence platform founded and created by Shaurya Agarwal.

This policy details how data is handled when you access the Service, run on-device evaluations, or communicate with us directly via email. This policy does not apply to third-party websites, external research papers, or linked services that we do not own or control.

Data Protection and Privacy Contact: hello@ceptile.com. Security and Vulnerability Disclosures: security@ceptile.com. Because the Service operates as a local-first software publication without physical commercial retail premises or call centers, email serves as our primary, monitored, and legally designated communication channel.

2. Summary — the whole policy in 30 seconds

• Zero upload of analysis content: Text, images, video, and audio submitted for evaluation are processed exclusively on your device’s local CPU and GPU. No content bytes are transmitted to Ceptile or any remote server.
• No user accounts or credential storage: We do not offer user accounts. We do not store names, email addresses, passwords, phone numbers, or user profiles.
• Zero tracking cookies: We do not deploy advertising cookies, tracking pixels, session replays, or fingerprinting scripts.
• No commercial data monetization: We do not sell, rent, broker, or trade personal data or submitted content under any circumstances.
• Email correspondence only: The only personal information we ever receive is what you voluntarily send us when emailing our support or security team, which is used strictly to answer your inquiry.

3. Zero-upload architecture: client-side processing across all media

The foundational architecture of AI Detector by Ceptile is engineered around absolute data minimization:

• Text Analysis: Natural language processing algorithms (including 46 statistical signal evaluators, Perplexity estimations, Zipf distributional ranks, burstiness metrics, and MATTR lexical diversity calculations) execute inside the browser’s JavaScript engine. No document payload is ever uploaded.
• Image Forensics: Image files dropped into the interface are loaded via the HTML5 File API into an in-memory HTMLCanvasElement. Error Level Analysis (ELA), Bayer Color Filter Array (CFA) residual checks, EXIF metadata parsing, and discrete cosine transform (DCT) frequency distributions occur entirely in local memory.
• Video Forensics: Video files are decoded in-browser using HTML5 Video elements and WebAssembly frames. Optical flow motion consistency, inter-frame temporal noise variance, and frame-level artifact detection operate strictly on-device.
• Audio Forensics: Audio files are analyzed using the client-side Web Audio API (AudioContext) to inspect high-frequency harmonic cutoffs, spectral centroid dynamics, and synthetic vocoder phase coupling without transmitting audio streams.
• Report Generation: Exported artifacts (PDF documents, JSON records, Markdown tables, CSV spreadsheets) are assembled in client RAM and downloaded directly through browser Blob and URL.createObjectURL mechanisms.

Because submitted content never exits your physical device, Ceptile possesses no legal or physical ability to access, intercept, subpoena, inspect, monetize, retain, or leak your analysis content.

4. What stays only on your device (localStorage & IndexedDB)

To enhance usability without compromising privacy, the Service utilizes client-side web storage mechanisms. This data is strictly local, encrypted at rest by your operating system, and is never transmitted over the network:

• ceptile-aid-theme: Stores your visual theme preference (dark, light, or system) in localStorage.
• ceptile-aid-history-v1: An optional on-device analysis ledger stored in your browser’s IndexedDB and localStorage, enabling you to review previous analysis results without an account.

You retain complete autonomy over this local data. You can delete individual history records within the UI, or trigger complete instantaneous erasure using the one-click control below:

5. What you choose to send us (email correspondence only)

The Service deliberately omits third-party chat widgets, CRM forms, and embedded tracking tickets. If you contact us at hello@ceptile.com or security@ceptile.com:

• Information Collected: Your email address, sender display name, message body, email headers, and any technical diagnostic attachments you provide.
• Purpose of Processing: To read, investigate, and respond to your inquiry (such as reporting false positives, bug remediation, methodology questions, or legal requests).
• No Marketing Solicitation: We will never enroll your email address into marketing newsletters, advertising campaigns, or sales sequences.
• Minimization Reminder: Please never email full confidential manuscripts, classified corporate data, or protected health information. Short excerpts (1–2 paragraphs) are sufficient for model calibration feedback.

6. Hosting infrastructure and ephemeral edge server logs

The Service is deployed as a pre-compiled static site distributed through high-performance Content Delivery Network (CDN) edge nodes (such as Cloudflare). When your web browser requests static files (HTML, CSS, JS, fonts), standard HTTP access logs are temporarily processed at the edge network layer for DDoS mitigation, bot defense, and service uptime verification.

• Logged Data: Requesting IP address, HTTP user-agent, referer header, timestamp, request URI, and HTTP response code.
• Payload Security: Edge logs record file transfer metadata only. Because document analyses occur post-load inside the client runtime, edge server logs contain zero document text, zero image data, and zero detection results.
• Retention Period: Network edge logs are ephemeral, rotated automatically, and permanently purged in accordance with industry security standards (typically within 7 to 30 days).

7. Cookies, tracking technologies, and zero-tracking guarantee

We deploy zero tracking cookies. The Service sets no first-party cookies, no third-party cookies, no session cookies, and no persistent marketing cookies.

Because we do not store tracking cookies or engage in user surveillance, no invasive cookie consent banner is presented: there are no advertising choices to toggle because there is no tracking to accept or reject.

8. Third-party services, external scripts, and subprocessors

Unlike conventional software-as-a-service (SaaS) applications that load dozens of external tracking scripts, AI Detector by Ceptile operates in a hardened, self-contained environment:

• Zero Remote Analytics: No Google Analytics, Segment, Mixpanel, or Amplitude.
• Zero Error Telemetry: No Sentry, LogRocket, or Datadog scripts inspecting your runtime state.
• Zero Advertising SDKs: No Meta Pixel, Google Ads, TikTok Pixel, or retargeting beacons.
• Self-Hosted Assets: All stylesheets, JavaScript code, and typography files (WOFF2) are served strictly from the first-party origin under strict Content Security Policy (CSP) headers.

9. Model training and commercial data exploitation guarantee

Major cloud AI detectors reserve the contractual right to ingest submitted documents into machine learning datasets to train future classifiers or generative models.

Our Guarantee: Ceptile never trains machine learning models on your documents, images, video, or audio. This is not merely an administrative policy setting that could be modified in the future — it is an immutable physical reality of our local-first software architecture. Because user data never crosses the network to our servers, we possess no pipeline capable of storing, harvesting, or training upon your intellectual property.

10. Educational privacy and student records (FERPA & COPPA compliance)

Educational privacy laws strictly govern the dissemination of student academic records:

• Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g): Under FERPA, student coursework constitutes personally identifiable educational records. When an educator inputs student writing into an external cloud detector, that action may constitute an unauthorized disclosure to a commercial third party. Because AI Detector by Ceptile evaluates coursework entirely on the educator’s local device, no third-party disclosure occurs, and no educational records are created or stored outside school control.
• UK & EU School Data Protection Standards: European educational guidelines mandate rigorous data protection impact assessments (DPIAs) prior to onboarding cloud AI tools. On-device processing eliminates student data transfers, satisfying data minimization mandates under Article 5(1)(c) of the GDPR.

11. European data protection (GDPR & UK GDPR legal compliance)

For individuals residing within the European Economic Area (EEA), United Kingdom, or Switzerland, processing of personal data is governed by the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK Data Protection Act 2018.

• Legal Bases for Processing (Article 6 GDPR):
  • Legitimate Interests (Art. 6(1)(f)): Delivering requested static application files, safeguarding server infrastructure against cyberattacks, and maintaining network availability.
  • Consent / Contractual Performance (Art. 6(1)(a) & (b)): Processing sender email information when you voluntarily initiate support inquiries, strictly to formulate a response.
• Data Subject Rights (Articles 15–22 GDPR): You have the right to request access to, rectification of, erasure of, or restriction of processing of your personal data, as well as the right to data portability and the right to object to processing.
• Right to Lodge a Complaint: You possess the statutory right to lodge a formal complaint with your competent supervisory authority (such as the UK Information Commissioner's Office (ICO) or your national EU Data Protection Authority).

12. United States state privacy laws (CCPA/CPRA, VCDPA, TDPSA)

In accordance with comprehensive state privacy statutes — including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and Texas Data Privacy and Security Act (TDPSA):

• Notice of Collection: In the preceding 12 months, we have collected no personal information from visitors who use the detector without emailing us. For correspondents, we collect email identifiers and message contents.
• No Sale or Sharing of Personal Information: We do not sell personal information, nor do we share personal information for cross-context behavioral advertising. We have zero incentive or mechanism to do so.
• Non-Discrimination: We will never discriminate against you, deny services, alter quality, or assess fees because you exercised any privacy rights granted by law.

13. Children’s privacy protection and age standards

The Service is a general-audience educational and professional utility. We do not knowingly solicit, collect, or maintain personal information from individuals under the age of 13 (or under 16 where required by local law), in compliance with the Children's Online Privacy Protection Act (COPPA).

If you are an educator or parent utilizing the Service with students under 13, analyses must be conducted under direct supervision. If we become aware that a child under 13 has transmitted personal data to us via email, we will immediately and permanently delete that communication upon receipt of notice at hello@ceptile.com.

14. Information security and technical safeguards

We employ industry-standard technical and organizational security controls designed to safeguard communications and infrastructure:

• Transport Layer Security: All connections to aidetector.ceptile.com require TLS 1.3 / HTTPS encryption, preventing eavesdropping and man-in-the-middle attacks.
• Rigorous Content Security Policy (CSP): We enforce restrictive CSP headers that forbid script injection, untrusted cross-origin resource execution, and unauthorized data exfiltration.
• Client Memory Isolation: In-memory canvas and audio buffers are cleaned by browser garbage collection upon tab closure or navigation.
• Responsible Disclosure: We maintain a monitored security reporting channel at security@ceptile.com for rapid remediation of security disclosures.

15. Data retention, archiving, and disposal schedules

• User Analysis Content: Zero retention. Document inputs, images, video, and audio are never recorded or stored on our servers.
• On-Device Browser Storage: Retained locally on your physical device until manually cleared via the on-device erasure control or browser settings.
• Support Email Correspondence: Retained only as long as necessary to resolve the inquiry, troubleshoot documented issues, or fulfill statutory recordkeeping requirements, after which it is routinely purged.
• CDN Access Logs: Ephemeral network traffic logs are automatically overwritten or deleted within 7 to 30 days.

16. Data Subject Access Requests (DSAR) and exercising your rights

To exercise your rights under GDPR, CCPA, or other applicable privacy legislation:

Please transmit a formal request to hello@ceptile.com with the subject line Data Subject Access Request. Please specify whether you are requesting verification, access, rectification, or deletion of correspondence records.

Important Architecture Note: Because our detector is strictly client-side and maintains zero server logs of your analyses, we cannot provide an “export” of past document checks. We can only search for and disclose email messages sent from your specific email address. We will respond to verified inquiries within statutory timeframes (30 days under GDPR; 45 days under CCPA) free of charge.

17. Cross-border and international data transfers

The Service’s static code assets are distributed globally via geographically dispersed edge servers to minimize latency. Because analysis calculations occur locally inside your device, your analysis content is never transferred across international boundaries. Voluntary email messages sent to us cross standard international email networks and are subject to standard email transit protocols.

18. Automated decision-making and profiling disclosures (Article 22)

Under Article 22 of the GDPR, individuals have the right not to be subject to decisions based solely on automated processing or profiling that produce legal or similarly significant effects.

No Automated Profiling: Ceptile does not conduct profiling, behavioural modeling, or credit scoring. Furthermore, as stipulated in our Terms & Conditions, our detection scores represent statistical indicators and must never be used as the sole basis for academic discipline, employment termination, hiring decisions, or legal actions without comprehensive, independent human review.

19. Revisions and material updates to this policy

We may periodically update this Privacy Policy to reflect technical enhancements, architectural updates, or statutory requirements. Any revisions will be posted to this URL with an updated effective date. In the event of any material modification that alters our zero-upload privacy architecture, advance notice will be published prominently across the platform.

20. Contact information and Data Protection officer

For questions, legal notices, or feedback regarding this Privacy Policy or our data protection practices:

Operating Entity: Ceptile (ceptile.com)
Founder & Lead Architect: Shaurya Agarwal
Primary Privacy Inbox: hello@ceptile.com
Security Inbox: security@ceptile.com
Web Platform: aidetector.ceptile.com

We are committed to addressing your privacy concerns promptly, transparently, and thoroughly.