Privacy Policy

CreatorPrivacyKit is a local-first web application. Most tools read files in your browser tab. CreatorPrivacyKit does not write user images to a database, KV, R2, or other persistent storage.

What we do not collect

We do not keep your images, videos, filenames, EXIF payloads, GPS coordinates, C2PA manifests, or sanitized exports. There is no account system.

AI Image Origin Detector

Local inspection runs in the browser. Official OpenAI verification happens only when the user explicitly requests it; the selected image is then sent to OpenAI through CreatorPrivacyKit's Worker for provenance verification. In URL mode, CreatorPrivacyKit's Worker temporarily retrieves the requested remote image so the browser can analyze it. The Worker performs a transient fetch: no KV, no R2, no database, and no persistent image storage. CreatorPrivacyKit does not make separate promises about how long OpenAI retains a file submitted to its Content Provenance API. See OpenAI's Verify tool and Privacy Policy. OpenAI Verify · OpenAI Privacy Policy.

AI Text Detector

AI Text Detector is remote analysis, not a local-only tool. Submitted writing is sent through CreatorPrivacyKit's Worker to TypeSafe System One. If TypeSafe times out, rate-limits, or returns an invalid or unavailable response, the Worker falls back to OrcaVerify Text 1.0. CreatorPrivacyKit does not intentionally persist submitted text, does not put body content in analytics, and does not keep application logs of the writing itself. URL mode fetches a public page, extracts main text, then sends that extracted text for analysis. File mode reads the document in the browser and sends only extracted text. TypeSafe and OrcaRouter document their own retention policies; those are their policies, not extra guarantees from CreatorPrivacyKit. Submitted text leaves this device. TypeSafe legal · OrcaRouter data handling.

What a static host may see

The host that serves index.html (for example a CDN) may log ordinary web requests: IP address, user agent, and the URL of HTML/CSS/JS assets. Those logs do not include the contents of files you drop onto the page.

Browser privacy checks

Browser Privacy Check, the fingerprint test, the canvas test, and the WebRTC test run only after you press Scan. They can read canvas, WebGL, offline audio, font measurements, screen and device hints, language, time zone, storage capability, privacy preferences such as Global Privacy Control, and WebRTC ICE candidates. The fingerprint digest is calculated in the tab and is not uploaded. Analytics for these tools record only tool_open, scan_start, and scan_complete, plus the tool id. Addresses, hashes, renderers, candidates, and the digest are not analytics properties. The WebRTC test may contact stun:stun.cloudflare.com:3478 after the scan starts, so the browser can learn ICE candidates. Those candidate lines are not posted into a CreatorPrivacyKit profile. This policy does not describe what the STUN operator retains. Browser Privacy Check and the WebRTC test can compare a public WebRTC address with the address this site sees on the request. That comparison stays off until you enable it. Enabling it sends one same-origin GET /api/network-info. The response can include the public IP already on that request, the IP version, and country or ASN when Cloudflare provides them. Application code does not write that response to KV, R2, D1, an application database, or a cross-session profile. Hosting and CDN logs described above can still record the ordinary request. A difference between the two addresses is an observation, not a finding that a VPN failed.

Cookies and ads

The core tool does not set first-party cookies to track files. If advertising or measurement scripts are added later, they are covered by their own policies and should never be given access to File objects from the dropzone.

Local processing

Inspection reads a 64KB header/tail slice via FileReader. Sanitization uses Canvas and in-memory ArrayBuffers. ZIP packaging uses JSZip in the same tab. Closing the tab discards all blobs.

Contact

Questions about this policy: use the contact method published on the site when available.