Privacy Policy

Account data. If you create an account we collect your email address. Your password is handled by our authentication provider (Supabase), is stored only as a hash, and is never visible to us. If you sign in with Google or GitHub, that provider shares your email and basic profile details (such as your name and avatar) with Supabase. We do not ask for your name ourselves.

Images you analyze. Files you upload, paste or link are processed in memory to read their metadata and provenance, and to produce a cleaned copy. We do not save them to disk or to our database, and we do not log their contents. If you analyze an image URL, our server downloads that image on your behalf.

Text you submit. The text you analyze is processed in memory and is not stored by us. If you use Rewrite Naturally or Deep Scan, the text is sent to an AI provider (see section 4). The standard scan runs on our own servers only.

Usage records. For each tool run we record the type of tool, success or failure, how long it took and any error code, linked to your account when you are signed in. For AI features we also record the provider, model and token counts. These records contain no image or text content.

Rate-limit counters. To enforce fair-use limits we keep short-lived counters keyed to your account ID, or to your IP address if you are not signed in. These expire within about two days.

Technical logs. Our logs contain a request ID, method, path, status code and timing. They do not contain request bodies, query strings, tokens or uploaded content. Our hosting providers may record IP addresses in their own infrastructure logs.

• We do not set advertising or analytics cookies, and we do not run analytics or tracking tools.
• When you sign in, our authentication library stores your session token in your browser's local storage. It is essential: without it you would be signed out on every page.
• We store your choice on the privacy notice in local storage, so we do not ask on every visit.

You can clear this at any time in your browser settings; the privacy notice will then appear again.

• To provide the tools you ask for, and to show your plan and daily usage.
• To authenticate you and keep your account secure.
• To apply usage limits, prevent abuse and control costs.
• To diagnose errors and keep the service reliable.

We do not sell your data, show ads, or build advertising profiles. We do not use your images or text to train models.

We do not sell or rent your data. We rely on these service providers, who process data only to run OriginLens:

• Supabase — authentication and our database (email, account and usage records).
• Vercel — hosting of the website.
• Our API host — runs the analysis service that processes your uploads in memory.
• OpenRouter and Groq — receive your text only when you use Rewrite Naturally or Deep Scan, and may route it to the underlying model provider. Their own privacy terms apply to that processing. Do not submit text you are not comfortable sending to them.
• Google and GitHub — only if you choose to sign in with them.
• A public exchange-rate service, used to show INR prices. It receives no personal data.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and service.

• Uploaded images and submitted text: not retained by us.
• Rate-limit counters: about two days at most.
• Account and usage records: while your account exists, and deleted on request (section 7).
• Logs: kept by our hosting providers for their standard log-retention periods.

We use encrypted connections, short-lived access tokens, strict input validation, safe image decoding, protections against server-side request forgery on image URLs, and rate limiting. No system is perfectly secure, so we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. To exercise any of these, email contact@originlens.com. We will respond within a reasonable time and within any period the law sets.

Our providers may process data in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.

OriginLens is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

If we change how we handle data, for example by adding analytics, we will update this page and its date, and will ask for your consent where the law requires it.

Questions about privacy: contact@originlens.com. Back to home.