Your text and files are processed in memory and deleted the moment your verdict is delivered — never stored, never used for training, never shared.

That is the whole policy in a nutshell. No account, no cookies, no third-party trackers, no consent banner. The rest of this page explains how we make the promise true, how we prove it on every release, and the few operational traces any website still leaves.

What happens to text and files you check

Everything you submit is processed entirely in memory. Our application code never writes your text or your files to disk — not to a database, not to a temp file, not to a log.

  • A normal scan holds your text in memory only for the seconds it takes to score it. When the response returns, the text is gone.
  • If the service is busy, your scan waits in an in-memory queue. The text is held in RAM only while it waits its turn, and it is freed the instant scoring finishes — before your verdict is even delivered.
  • Your verdict is deleted the moment you fetch it. A queued result that is never fetched is purged by a background timer within five minutes, even if nobody else ever visits.
  • Stored verdicts never contain your words. While a queued result waits to be fetched, it holds scores, numeric highlight positions, and signal names — not one character of your input.
  • Uploaded files are parsed in memory too. The provenance check reads your PNG, JPEG, DOCX, or PDF from memory, answers immediately, and keeps nothing. The response carries only the file kind and short metadata summaries — never the file.
  • Errors never echo your input. Every error is a typed code with a fixed message. No stack traces, no quoted text, no request bodies in diagnostics — by construction, and by test.
  • Never used for training. We do not use submitted text or files to train, tune, or evaluate anything. There is no opt-out because there is nothing to opt out of.

We test this automatically on every release

A promise like this is only worth something if breaking it breaks the build. Our release checks include an automated no-persistence test: it runs real scans and real file uploads, each seeded with unique marker strings, and then proves those markers exist nowhere — not in any file on disk, not in the in-memory result store after delivery, not in the process logs. A companion check deliberately plants leaks to confirm the test would catch them. If Cobalynx ever kept your text, our own release pipeline would fail before the change shipped.

Server logs — the honest remainder

Like every website, we keep standard connection logs so we can keep the service up and block abuse. Ours are anonymized at write time: before a request line touches disk, the last segment of your IP address is removed (the final octet for IPv4; IPv6 addresses are truncated). The full address exists only in memory while your request is being served.

  • Connection logs hold: a timestamp, the truncated address, the URL path, the response status and sizes, and your browser's user-agent string. Your text travels only in request bodies, never in URLs — so it cannot appear in these logs.
  • Operational logs hold: startup lines and typed error codes from our own processes. Never request content.
  • One aggregate statistic survives restarts: the service's measured processing speed, a single words-per-second number that powers the honest queue estimates. Nothing in it derives from any individual text.
  • The server runs without swap, so memory holding your text is not paged to disk by the operating system.

Visit statistics

Visit counting, when it is enabled, uses a self-hosted, cookieless analytics instance running on our own server: aggregate page-view counting, no cookies set, no cross-site identifiers, and no data leaving our infrastructure. It is off by default, and turning it on changes nothing a third party can see: there is no Google Analytics, no advertising pixel, no social widget, no CDN-hosted script phoning home, whether it is on or off. If we ever change that, this page changes first, with a dated entry in the history below.

No cookies, no trackers — and why there is no banner

Consent banners exist to authorize cookies and trackers. We set no cookies and run no third-party trackers, so there is nothing to consent to — which is why you did not see a banner. If that ever changes, this page will change first, with a dated entry in the history below.

Content certifications

Ordinary scans are zero-retention, and so are free certifications: the certification report is self-contained — it carries the text's SHA-256 fingerprint, score, date, and detector version — and nothing about it is stored on our servers. Hosted certificates, when they open from the waitlist, will be the one deliberate exception: creating one will mean asking us to store that exact text, its fingerprint, and its verdict so a public verification page can exist — and deleting the certificate will delete the stored text with it. That exception ships only after this policy states it in the same release.

What a certification is, and what it honestly claims, is on the content certification page.

Your rights (GDPR)

Controller. Roviant S.r.l., Italy. Contact: contact@cobalynx.com.

The controller is a real, named operation: Roviant S.r.l. is an Italian limited liability company, and Cobalynx is built and maintained by its CEO, Mario Federico. Questions about this policy or your data go to contact@cobalynx.com and are answered by the people who actually run the service.

What we process, and on what legal basis. Your submitted text and files are processed transiently — for the duration of the check you asked for — under Article 6(1)(b) GDPR (processing necessary to deliver the service you requested). The anonymized connection logs above are kept under Article 6(1)(f) (our legitimate interest in security, rate-limiting, and abuse prevention).

The honest shape of your rights here. You have the full set of GDPR rights: access, rectification, erasure, restriction, portability, and objection. For submitted content, the truthful answer is that there is usually nothing to exercise them against — your text is deleted before our reply even reaches you, and nothing we retain can be linked back to you. Under Article 11 GDPR we are not obliged to collect extra data just to identify you for a rights request, and we will not: answering "who asked us to scan this?" is impossible by design.

Complaints. You can lodge a complaint with a supervisory authority — ours is the Garante per la protezione dei dati personali (Italy) — or with the authority of your own country of residence.

Related pages

The rules for using the service are in the Terms of Service. How verdicts are computed, and the measured error rates behind them, are on the methodology page and the evidence page.

Drafted ; pending professional legal review. This page states our own policy in plain language; if it and reality ever diverge, reality wins and we fix the page.