Documents you submit

Documents you paste, upload, or photograph are processed ephemerally to generate your risk report. We do not retain document contents after your scan completes, and we do not use your documents to train models. Limited metadata linked to your account is recorded: the document category, overall risk level, operation type, and time.

To generate your report, the document text is sent to OpenAI, our AI analysis provider, under API terms that do not use it to train models. We additionally set the no-storage flag on every request, so no application state is created for the response. Unless and until our exact production project is approved and verified for Zero Data Retention, OpenAI may retain an abuse-monitoring copy for up to 30 days. We cache only our own static instructions and output schemas; your document, images, OCR text, questions, findings, and reports are always placed after the cache boundary and are never used as a cache key. No other third party receives your document content.

The same rules apply to the follow-up tools. If you ask questions about a report, the document text held in your browser tab is sent to OpenAI to answer them, under the same no-training terms and retention limits described above. Comparing two reports or drafting a negotiation reply sends only the reports' findings, never the document text. In every case, the results exist only in your browser tab unless you export or save them yourself.

If you turn on optional report history, reports are kept only in this tab's memory for comparison. They are not written to browser storage and disappear when the tab is refreshed or closed. You can download a PDF to your own device when you want a lasting copy.

Government and identity documents

Some documents you scan, such as immigration or other government forms, may contain identifiers like passport numbers or case numbers. These pass through the same ephemeral pipeline as every other document and are never stored by us. If you prefer, you can redact identification numbers before scanning; doing so does not reduce the quality of the analysis.

When you run the optional official source check, we search public government websites using mechanically constructed generic queries containing only an approved lookup category, jurisdiction, and a safe generic reference such as a form number or statute. The search-enabled request never receives the document, its raw claim, your name, address, case or receipt number, or other personal details. If a safe query cannot be constructed, that check is skipped rather than risking disclosure.

Account information and service providers

If you create an account, we store your email address, credit balance, and scan metadata (time, document category, risk level, and whether the operation was a scan or verification). We also store narrow purchase records (payment transaction ID, amount, currency, and credits granted), invite-redemption email/code audit data, and OCR page usage counters. Authentication and our database are hosted on Supabase. Purchases are processed by Dodo Payments, our merchant of record, which handles your payment details; we never see or store full card numbers. We do not sell your personal information, and we do not use it for advertising.

Account, scan, and purchase metadata is kept until you delete the account. Legacy OCR counters are kept for no more than 30 days. Invite audit data remains identifiable until account deletion; deletion replaces its email with a random redacted value while retaining only the non-identifying code-use audit. Dodo Payments may retain its own transaction records under its legal and merchant obligations.

Cookies

We use only the cookies required to keep you signed in. There are no advertising or cross-site tracking cookies on Hidden Catch.

Security and abuse prevention

To protect the service from automated abuse, we apply short-lived rate limits keyed to your account and trusted proxy-derived IP address. These counters are processed by Upstash and expire within minutes. Paid AI work also uses opaque job IDs, reserved and consumed work units, batch indexes, status, and expiry; these records contain no filename, document hash, text, excerpt, finding, query, or report, and are finalized or expire within an hour. Follow-up question tickets contain only a random ID, account ID, remaining-use count, content-free provider-budget counters, and expiry, and expire within 24 hours.

Your rights

You can ask us at any time to tell you what personal information we hold about you (it includes the account, purchase, invite-redemption, OCR-use, and scan metadata listed above), to correct it, or to delete your account. Account deletion removes the account-linked database rows and irreversibly replaces the invite-redemption email with a random redacted value so the code-use audit can no longer identify you. Email us at the address below and we will act on the request promptly. We will never treat you differently for exercising these rights. If you are in a jurisdiction with specific privacy laws, such as the EU/EEA, the UK, or California, these rights apply to you under those laws; where local law grants you more, local law prevails.

Where data is processed

Our servers and database are hosted in the United States, so the limited account data described above is processed there. The protections described in this policy apply to your information regardless of where you live.

Contact

Questions about this policy, or a privacy request? Email support@hiddencatch.com. We usually reply within one to two business days.