Humanora

Trust

Security & Trust

Last updated: October 14, 2026

You trust us with your writing. This page lists the concrete measures we use today. We have not yet completed any third-party security certification, and we will only claim one once we have it.

Never used for training

Text you submit is never used to train AI models. It is processed by our own model, not a third-party AI API.

No Gmail access

Google sign-in asks only for your basic profile and email address. We cannot read your mail, contacts or files.

No card data

Payments go through Paddle. Card details never touch our servers.

Your text, your control

Delete any document, or your whole account, from inside the app.

No ad trackers

No advertising cookies, no third-party analytics, and we don’t sell data.

Accounts and sign-in

  • Passwords are stored only as Argon2 hashes.
  • Sign in with Google uses the OpenID Connect authorization-code flow with PKCE.
  • Sessions use short-lived access tokens (15 minutes) and rotating refresh tokens, stored only as hashes, in HttpOnly cookies.
  • You can see your active sessions and sign out of all of them at once.
  • Sign-up and log-in are rate limited and protected by Cloudflare Turnstile against bots.

API keys

  • Keys are shown once. We store only a keyed hash (HMAC-SHA256) and the last 4 characters.
  • Keys can be scoped, given an expiry, rotated with a grace period, and revoked at any time.

Infrastructure

  • All traffic is encrypted with HTTPS and served through Cloudflare.
  • Payment webhooks are signature-verified before they change anything.
  • For free accounts with no sign-in or use for 30 days, documents, rewrite history, session records and API usage logs are deleted automatically. The account itself stays so you can come back. Paid accounts keep their data while the subscription is active.
  • Deleting your account (confirmed with your password, or by signing in to Google again) removes your documents, rewrite history, API keys, sessions and Google connection from our database.

Reporting a vulnerability

If you find a security issue, email [email protected] with the details. Please give us reasonable time to fix it before disclosing it publicly. We won’t take action against good-faith research that avoids harming users or their data.

More detail on data handling: Privacy Policy.