Privacy Policy

Last updated: 6 November 2026.

Who is responsible?

unslop, Germany. Contact: info@unslop.run. Contact the operator with privacy requests.

What we process and why

• Website delivery and security: connection information, IP addresses, request times and technical logs help deliver the site, prevent abuse and diagnose faults. Our basis is legitimate interests under Article 6(1)(f) GDPR.
• Accounts and purchases: email address, login verification, session identifiers, word balances, transactions and support correspondence are needed to provide the service and fulfil purchases (Article 6(1)(b)). Statutory accounting obligations may require retention under Article 6(1)(c).
• Detection and rewriting: we process submitted text, uploaded documents, extracted features, scores, generated alternatives and repair decisions to supply the requested result. Some detection runs in the browser; server-side operations send the relevant information to our infrastructure and model providers. Do not submit confidential or sensitive personal information unless you are authorised to do so.

Google sign-in

If you choose to continue with Google, Google authenticates your account and shares an account identifier and verified email address with us. We use these to sign you in or create your unslop account. We request no access to Gmail, Drive or other Google content. Email-code login remains available.

Rewrite history and model improvement

We store rewrite history, including originals, outputs, accepted and rejected candidates, detector scores and workflow decisions, associated with an account or request. Rewrite history has a 180-day retention period. These records can support debugging, quality review and development of our rewriting and review models.

For new account registrations and rewrite requests, we record the country reported by Cloudflare to understand regional service usage. These country records are linked to the relevant account creation or rewrite request, retained for up to 180 days, and used in our private operational dashboard. This record does not contain raw IP addresses, city locations or coordinates.

Service providers and transfers

Cloudflare provides hosting, security, account email, databases/storage and model inference. RunPod provides GPU inference. OpenAI provides model inference for some rewrite components. Stripe processes payments; we do not need to store full payment-card details. Only providers actually used for a request receive its relevant data.

Some providers may process data outside the EEA. Contact us for information about the providers involved in processing your request and applicable transfer safeguards.

Detector service counts

After a completed detector check, we send its score rounded to two decimal places to our own backend, independently of optional analytics consent. We store the score, the receipt time rounded to the minute and the country reported by Cloudflare for up to 180 days to monitor detector usage. This report does not send the document, account details, cookies or a persistent visitor identifier. We do not store IP addresses, user agents or referrers in these report records. Network connection information is still processed by our hosting provider when delivering the request. These are counts of reported checks, not unique people.

Cookie-banner measurements

Independently of optional tracking consent, we count displays of the cookie banner and whether a choice is submitted, including acceptance, rejection and custom choices. Each display gets a new random identifier held only in that page’s memory so its choice can update its display record. It is not stored in cookies or local storage and does not link pages, accounts or detector checks. We retain this identifier, minute-level times, whether this was an initial prompt or reopened settings, and the resulting choice for up to 30 days in our backend and local dashboard. These records do not contain text, IP addresses, location, page URLs, referrers or user agents. They measure banner displays, not unique people. A record without a choice may reflect an open page or a missing report.

Cookies, storage and optional tracking

Essential local storage supports sign-in, saved text and your privacy preferences. The session token is stored under unslop_session_token. Your consent choice is stored under unslop_consent_v1 for up to 180 days. These functions do not depend on accepting optional tracking.

Only if you consent to Analytics, Google Analytics and our optional browser usage events may measure page visits, button clicks, signups, detector and rewrite interactions, and confirmed purchases. Purchase measurements contain the package, amount, currency and a pseudonymous transaction identifier, not payment-card details. The detector service counts described above and backend rewrite records are separate from this optional tracking. Google tags are blocked until consent. Our integration excludes submitted text, account email and query strings from event payloads. Google identifiers may use _ga cookies; the cookie lifetime is 180 days. Older anonymous usage integrations may use us_sid.

Only if you consent to Advertising, the OpenAI Ads Measurement Pixel may measure page visits, completed registrations and confirmed purchases to help attribute advertising. Purchase events include the package, amount, currency and a pseudonymous order identifier. Local records under unslop_measurement_orders_v2 prevent duplicate purchase measurements for each enabled provider for up to 30 days. The older unslop_ads_orders_v1 record remains recognised to avoid resending previously measured OpenAI purchases. The pixel can use __oppref (30 days) and __obref (365 days). We do not intentionally pass email addresses or manuscript contents to the pixel.

Pricing views and return visits

With Analytics consent, we measure when a pricing card is at least 25% visible for one second, visits to signed-in pages, and successful checkout creation before redirecting to Stripe. Records contain the event time, page category and, when signed in, your account ID and plan. Signed-in events are deduplicated in 30-minute intervals. Anonymous pricing-view records use a new in-memory event ID and are counts of views, not unique people. We do not store document text, IP addresses or full URLs in these records. We retain them for up to 180 days. Return rates are calculated from later activity; we do not infer historical visits that were not recorded.

Homepage experiments

We use a secret-keyed hash of your network IP address to consistently select a homepage layout. Country is not used in this selection, and the experiment does not store the raw IP address or set an assignment cookie. People sharing an IP may see the same layout; changing networks may change it. Only with Analytics consent do we record a pseudonymous assignment identifier, layout and exposure time, and link a completed new registration to that assignment. These experiment records are retained for up to 90 days and are not sent to advertising platforms. Withdrawing Analytics consent stops further experiment measurement.

Meta Pixel and TikTok Pixel: prepared, not active

We have prepared integrations for Meta Pixel (Facebook and Instagram advertising) and TikTok Pixel. Both are currently disabled because no pixel IDs are configured. Accepting cookies does not load either provider while it remains disabled.

If enabled, these pixels will load only after you accept Advertising or choose Accept all. They can measure page visits, completed registrations, completed rewrites and confirmed purchases to attribute and improve advertising. Purchase events include the package, amount, currency and a pseudonymous order identifier. We do not send manuscript text, detector scores, uploaded files, account email addresses or payment-card details as pixel event parameters, and we do not enable advanced matching in our integration.

When a pixel is active, its provider receives connection and browser information such as IP address, user agent, page URL, advertising click identifiers and cookie identifiers, and may associate activity with an account you hold with that provider. Meta may use first-party cookies such as _fbp and _fbc. TikTok documents first-party _ttp, ttclid and ttcsid cookies, with durations of up to 13 months from last use, and may use cookies on its own domains. These cookies are not set by our disabled placeholders. See Meta’s cookie policy, Meta’s privacy policy, and TikTok’s pixel cookie information.

Accept all accepts both Analytics and Advertising for the enabled integrations. Reject all rejects both. Settings lets you choose them separately. When you withdraw consent, we stop optional tracking, revoke consent with loaded pixels, clear the optional first-party cookies and purchase-deduplication records we control, and reload the page. We cannot directly delete cookies on a provider’s own domain; you can manage those in your browser or provider account. Necessary login, document and preference storage remains available.

Optional processing relies on consent under Article 6(1)(a) GDPR and, where applicable, §25(1) TDDDG. Use “Cookie settings” on any page to reject, change or withdraw consent. Withdrawal does not invalidate processing already performed. Necessary storage is addressed separately under §25(2) TDDDG.

Retention and your rights

Account information is retained while needed to supply the account; transaction records may need to remain for statutory periods. You can request access, correction, deletion, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw consent. Write to the contact above. We may need to verify your identity.

You can complain to a German data-protection supervisory authority, including the authority in the federal state where you live or work. Detector results are writing-pattern estimates, not proof of authorship; unslop does not make academic or disciplinary decisions about you.