Legal
Privacy Policy
Last updated: October 14, 2026
This policy explains what personal data Humanora collects, why, who else handles it, and the choices you have. It covers humanora.app, the app at app.humanora.app and the Humanora API. Humanora is operated by Humanora, Kathmandu, Nepal 44600 (“we”, “us”).
The short version
- We collect what we need to run your account: your name, email address and, if you use Google sign-in, your Google profile name and photo.
- We ask Google only for
openid email profile. We cannot read your Gmail, contacts, Drive or anything else in your Google account. - Your text is never used to train AI models.
- Text you paste is processed to detect and rewrite it. For signed-in users it is saved as documents until you delete them.
- Payments are handled by Paddle. We never see or store your card number.
- We do not sell your personal data and we do not use advertising trackers.
1. Data we collect
| Data | When | Why |
|---|---|---|
| Name and email address | When you create an account | To identify your account, sign you in and contact you about it |
| Password (stored only as an Argon2 hash) | Email and password sign-up | To sign you in. We cannot see your password. |
| Google account ID, email, name, given name and profile photo URL | Sign in with Google | To link your Google login to your Humanora account and show your name and photo |
| Profile photo | If you upload one, or from your Google profile | To show your avatar in the app |
| Text you submit, rewritten output, AI-detection results and document titles | When you use the detector, humanizer, file upload or API | To provide the service. Signed-in users’ documents are saved so you can come back to them. |
| Word usage and credit balance | When you run checks or rewrites | To apply plan limits and show your usage |
| Session data: IP address, browser user agent, sign-in and last-used times | Each sign-in | To keep you signed in, let you see and sign out other sessions, and protect your account |
| Device identifier, IP address and a hash of your email at sign-up | Account creation | To prevent abuse of free plans (for example mass account creation) |
| Billing records: Paddle customer and subscription IDs, plan, status and billing email | When you subscribe | To give you the plan you paid for |
| API key metadata: name, last 4 characters, request and word counts per day, last-used time and IP | When you use the API | To run the API, show usage and detect misuse. The key itself is stored only as a keyed hash. |
| Security and audit logs (for example sign-ins, key changes, account deletion) | Ongoing | To secure the service and investigate problems |
| Your settings (default tone and level) | When you change them | To remember your preferences |
Visitors who try the free checker on the homepage without an account: the text is sent to our servers to be scored and rewritten, and a cookie plus your network address are used to count free checks. We do not ask for your name or email.
2. How we use your text
We never use the text you submit to train or improve AI models.
Your text is scored and rewritten by Humanora’s own custom fine-tuned humanizing model. It runs on GPU servers that Humanora operates through a GPU cloud hosting provider. We do not send your text to any third-party AI service such as an external chatbot or language-model API.
We do not publish your text, and staff access it only when needed to operate the service, fix a problem you report, or comply with the law.
3. Legal bases (EEA/UK users)
- Contract: running your account, processing your text, billing.
- Legitimate interests: security, fraud and abuse prevention, keeping the service working.
- Consent: the optional homepage cookie for extra free checks. You can decline it.
- Legal obligation: tax and accounting records.
4. Who else processes data
| Provider | What they do | Data involved |
|---|---|---|
| Paddle | Payment processing, tax and invoicing. Paddle is the merchant of record for purchases. | Billing details, email, payment method (held by Paddle, not us) |
| Optional “Sign in with Google” | Sign-in request; Google returns your basic profile to us | |
| Cloudflare | Network delivery, DDoS protection and the Turnstile bot check on sign-up and log-in | IP address, request metadata, browser signals for the bot check |
| Google Fonts | Fonts on humanora.app | Your IP address and browser details when the font files load |
| GPU cloud hosting provider | Provides the GPU servers our own model runs on | Text being processed, only while it is processed |
| Hosting and database | Runs the app and stores data in a PostgreSQL database on servers operated by Humanora | All account data described above |
We do not sell or rent personal data and we do not share it for cross-context advertising.
5. Retention
- Documents, rewrite history, session records and API usage logs: kept while your account is active. If a free account has no sign-in or use (app or API) for 30 days, an automatic daily job deletes your documents and their rewrite history, all session records (IP address and browser), and your API key activity log, daily usage counts and last-used IP. Deleting a document removes it straight away.
- Paid accounts are not affected by this cleanup: their data is kept while the subscription is active, including after you cancel until the paid period ends. Once it has ended, the account is treated as a free account.
- Your account itself (name, email, sign-in methods, plan, word balance and API keys) is not deleted for inactivity, so you can come back. Delete it any time yourself (see below).
- Ended sessions: records of sessions that expired or were signed out are deleted 30 days after they end, for every account.
- Server logs (for example sign-in and security events, with masked email addresses) are rotated automatically and are not kept per account.
- Sessions: expire after 12 hours, or 30 days with “remember me”.
- After account deletion we keep a one-way hash of your email address with your remaining free-word balance, and sign-up records (IP, device ID, hashed email), so deleting and re-creating an account cannot reset free limits. These hold no readable email address.
- Billing records: kept as long as tax and accounting law requires. Paddle keeps its own records under its privacy policy.
6. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or California’s CCPA/CPRA), you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. You will not be treated differently for using these rights.
- Correct: change your name, photo and settings in the app.
- Delete documents: delete them one by one in the app.
- Delete your account: Settings → Danger zone → Delete account. You confirm with your password, or, if you sign in only with Google, by signing in to Google again. Cancel any active subscription first so you are not charged again. Deletion removes your account, documents, rewrite history, API keys, sessions and Google connection at once. If you cannot delete it yourself, email [email protected] from the account’s address and we will do it.
- Disconnect Google: you can also remove Humanora at myaccount.google.com/connections.
- Access or export: email [email protected]. We reply within 30 days.
You may also complain to your local data protection authority.
7. Security
See our Security page for how we protect data. No system is perfectly secure, and we will notify affected users of a breach as the law requires.
8. International transfers
Our providers may process data outside your country. Where the law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses offered by those providers.
9. Children
Humanora is not for children under 16. We do not knowingly collect their data; contact us and we will delete it.
10. Cookies
See the Cookie Policy.
11. Changes
We will update the date above when this policy changes and tell signed-in users by email or in the app about material changes.
12. Contact
Humanora, Kathmandu, Nepal 44600. Email: [email protected].