HumanFlow Product Privacy — Local Cleaner and AI Features

Processing boundaries at a glance

HumanFlow has separate tools with separate data flows. The local formatting cleaner and writing-pattern checker run in your browser. Their implementations do not need to send pasted text to a HumanFlow endpoint. The AI humanizer is different: when you explicitly request a rewrite, the submitted text is processed by the application server and the configured model provider. Do not use the humanizer for confidential text unless that processing boundary is acceptable to you.

This table describes the product contracts implemented in this repository. Browser extensions, corporate proxies, operating-system services, and unrelated third-party software are outside this boundary.

Local cleaner data

The local cleaner accepts pasted text only inside its client-side editor. Deterministic rules inspect characters, produce an output string, and keep undo data in the current browser state. Copy and download actions are initiated by you. The cleaner does not place pasted text in a URL, server-rendered HTML, application log, or analytics payload.

The allowed local-cleaner event fields are limited to an event name, page ID, locale, selected rule IDs, aggregate change counts, aggregate artifact counts, a success outcome, and a coarse duration bucket. The event validator rejects text, snippets, hashes, diffs, arbitrary URLs, and unknown properties. Emitting the browser event does not itself transmit it to a server.

Pattern checker data and limitations

The writing-pattern checker analyzes text in the browser. It reports heuristic signals and is not an authorship test. Its current browser boundary is covered by an automated test that rejects imports or calls to a fetch API, server action, or application API route from the checker client implementation.

Do not interpret a local processing statement as a claim that the entire website is offline. Loading the page still involves ordinary web requests for HTML, scripts, styles, fonts, images, and any analytics provider enabled by site configuration.

Humanizer and server processing

The humanizer changes wording. A rewrite request may send the submitted text to the HumanFlow application server and then to the model provider configured for the deployment. Model output can change meaning, omit facts, or introduce errors, so review it before use. The humanizer is not part of the local-cleaner privacy promise.

The exact provider and its retention terms depend on deployment configuration. This page does not claim a provider name, retention period, training exclusion, or geographic processing location that the repository cannot verify. The site owner must publish those deployment-specific facts before making a stronger promise.

Accounts, billing, and operational requests

Account, authentication, billing, email, support, and abuse-prevention features necessarily use server requests. Depending on which features the site owner enables, those requests can contain account identifiers, session data, billing references, email addresses, IP-derived request information, and ordinary technical logs. Payment card handling belongs to the configured payment provider; HumanFlow should not claim that no provider receives billing data.

Do not paste passwords, authentication tokens, private keys, medical records, legal secrets, financial account data, or confidential client material into a feature with a server or model-processing boundary.

Analytics and configuration

The codebase supports optional analytics integrations, including Google Analytics, Microsoft Clarity, Plausible, Vercel Analytics, and Umami. A provider is loaded only when the corresponding deployment configuration is enabled. Because runtime configuration can change independently from this document, the presence of a supported integration does not prove that it is active on a particular deployment.

Analytics providers may receive ordinary page and device information under their own implementations. The local cleaner's product event contract intentionally excludes pasted text. Site operators must review active configuration and provider terms before deployment.

Retention, deletion, and corrections

Browser-only cleaner state lasts only as long as the page and browser retain it. Server-side account, billing, support, security, and humanizer retention cannot be inferred safely from source code alone. Until the operator publishes a verified retention schedule and contact channel, no fixed deletion period is promised here.

Corrections to this page must be tied to an implementation review. If a product boundary changes—for example, if a local tool begins making a text-bearing request—the disclosure and its claim tests must change in the same release.

Related technical evidence

Read the cleaning methodology for rule definitions, defaults, destructive-risk labels, fixtures, and known limitations. The AI text cleaner remains the canonical local-cleaning surface, while the AI humanizer owns rewriting.