Where your manuscript goes, and where it stops.
Everything on this page is a decision in the code, not a promise in marketing copy.
The path a file takes
Your browser to this site
Over HTTPS. Your manuscript never travels from your browser to the check engine, so the engine's key never exists in any page or script.
This site to the engine
PHP reads the file into memory and deletes its own temporary copy before the engine is called at all. The call carries a shared key in a header. The site is hosted by Hostinger and the check engine by Render.
The engine reads it, then drops it
It is written to a temporary path, parsed, and unlinked in a finally block, so it leaves the disk whether or not the parse succeeded. The manuscript assessment that follows reads it in a process and a folder of its own, and the folder is deleted the same way.
What survives is the result
We ask the engine not to build a retrievable report at all. What comes back is counts, limits and findings. A finding may quote the sentence it rests on: the quote goes to your browser and is stored nowhere. A corrected copy leaves with the response that made it.
The check never calls an AI
The check itself is arithmetic and parsing in Python. It has no model to call and makes no outbound request.
AI assist is a separate step you start yourself, and it is Claude only: the engine is set to offer no other provider, and the form names the provider before you agree. Before anything is sent you pick one of two modes, and you tick a box for that request.
Send nothing from my manuscript
The model sees the journal’s requirements this check found, and the facts you type. Nothing from your file. It answers by naming what else it needs.
Send the parts each action needs
Title, abstract, keywords, section openings, a few reference samples, the counts and the findings. Each action sends only its own list, never the file.
- The excerpts are sealed with a signature keyed to our own API key, and they expire after three hours.
- They live in your browser, not on our server.
- The endpoint accepts only text our own engine extracted, so it cannot be turned into a free AI proxy.
- Excerpts are never written to a log.
What we keep
Without an account
- A random id in a cookie that lasts 30 days, and two counters that expire within the day: one for that id and one for your address, kept as a hash. That is how your one free check a day is counted.
- For half an hour after any check, signed in or not, a ticket that lets the same browser ask for the manuscript assessment. It holds the kind of file, which checks were reported, the cookie id or account it was issued to, and how many times it has been used. Nothing from the file.
- If you ask the site guide a question: the question goes to Claude through our engine with the page you are on, and a second cookie id and counters that expire within the day keep it from being abused. No manuscript, no account.
- No account, no history, no record of who you are.
With an account
- Your name and your email address, and whatever you add to your profile: institution, research area, ORCID iD, a short bio, a picture. A picture you replace or take off is deleted.
- Up to 30 past checks: journal, ISSN, date, verdict, readiness and how many items came out each way. Not the file. Not even its name.
- Your preferences, how much of this month's free AI allowance you have used, and any credit you bought with its expiry date.
- While you are signed in, WordPress's record of the session: when it began, when it ends, and the IP address and browser it began from. It goes when the session does.
- A log of the email the site sends, with the recipient, subject and body of each message, for 30 days.
- You can switch the history off, or clear it, on your account page, and delete the account there.
When you pay
- Nothing about your card. Wayl handles payment; those details never reach us.
- A record of the payment: the plan, the amount, the date, its status, the method and Wayl's reference. It is kept for our accounts, also after an account is deleted.
- A plan is granted only when Wayl's webhook arrives signed with that payment's own secret and reports it paid for the right amount.
- Returning to the site grants nothing by itself.
What we do not have
The same rule as the check itself: we show you what we cannot confirm rather than let you assume it.
- We hold no ISO 27001 or ISO 42001 certificate, and no SOC 2 report.
- We have not commissioned an external penetration test.
- We are a small team, not a certified enterprise vendor.
What we do have is a short list of places your work can be: this site, the check engine for the seconds it takes to parse, and Claude only if you ask. The privacy policy says what we do with data and why. If you need a specific answer, write to us.