Cheirograph checks whether text was written by a person or by AI. To do that it has to read text and send it to a detector. This page says exactly what is sent, where it goes, and what is kept. It covers the Cheirograph browser extension and the website at cheirograph.vercel.app.

What is sent
Extension: text that is visible on the page you are looking at, in pieces of about 20 to 400 words by default. Only text that is actually on screen is sent, not the whole page, and nothing from sites on the never-check list or from pages with a password field (unless you turn that option off).
Website: the text you paste into the box, when you press Check.
Where it goes
Text is scored by a detector model running on a single private server operated by the developer. It is sent over HTTPS through Tailscale Funnel, whose relay forwards the encrypted connection without being able to read it; the connection is decrypted only on that server.
Requests from the website pass through Vercel, which hosts the site and forwards them to the server. Vercel handles the text while forwarding it but does not keep it.
Text is never sold, shared, used for advertising, or used to train models.
What is kept
The text itself: never. It is held in memory only while it is scored, then discarded.
Server request log: one line per request with the time, the request type and the status (for example "POST /api/detect_batch 200"). It contains no text, no scores and no IP addresses, and it is erased whenever the server restarts.
Rate limiting: to stop abuse, the server counts requests per IP address for one minute at a time, in memory only. IP addresses are never written to disk.
In your browser (extension only): a cache of recent results so the same text isn't sent twice. It stores a one-way hash of each piece of text and its score, never the text, and holds at most 5,000 entries. Your settings are stored in your browser too. Clear the cache from the settings page, or remove everything by uninstalling the extension.
Tailscale and Vercel keep their own short-lived connection logs (such as time and IP address) under their own privacy policies. Neither records the text.
Your controls
Turn the extension off at any time by clicking its toolbar icon.
The never-check list stops it from reading or sending anything on the sites listed. It starts with patient portals, banks, payment and crypto services, tax and government ID sites, password managers, and payroll and HR sites, and you can add any site (right-click the toolbar icon and choose "Never check this site").
By default it pauses on any page with a password field.
Accuracy
The detector can be wrong in both directions, more often on short texts. Treat its results as a signal, not proof, and don't use them as the only basis for decisions about a person.

Children
Cheirograph is not directed at children under 13 and does not knowingly collect personal information from them.

Changes and contact
If this policy changes, the new version will be posted here with a new effective date. Questions: alexanderfavvas@gmail.com.