What happens to what you paste
Short version: the contract is thrown away, the score is kept, and nobody is sent anything.
Opening a file
A .docx or .pdf you open is never uploaded. The file is read inside your own browser, the text is pulled out there, and only that text is sent to be checked. The file itself never crosses the network, which is why opening one is no different, privacy wise, from pasting.
The contract check
The text you paste or open is sent to the server, matched against a fixed set of patterns, and the result is sent back. The text is not written to disk, not put in a log, not sent anywhere else, and not held in memory after the response. Reloading the page cannot bring it back, because there is nothing to bring back.
What is recorded is the score out of twelve and which of the hazard phrases were found. Those are numbers, kept to learn what agreements in use actually look like. They cannot be turned back into a document.
The calculator
The figures are sent, calculated and returned. Only the one total is counted, and it is not attached to anything that identifies you.
Visits
There is no analytics service, no tracking pixel, no advertising tag and no cookie. The page loads nothing from any other domain, which the content security policy enforces rather than merely promising.
To count how many people visited rather than how many times the pages were opened, a one-way hash derived from your network address is stored. The address itself is never written down, and the hash is meaningless outside this service: it cannot be matched against anything else, reversed, or used to contact you.
The value used to make that hash is held steady for the duration of this trial, because otherwise every deployment would turn returning visitors into new ones and the counts would be wrong. It is discarded when the trial ends, which permanently breaks the link between a stored hash and any address.
The waitlist
If you give an email address, it is stored so that one message can be sent when there is something to use. It is not passed, sold or rented to anyone. The optional answers about the kind of work you do and what the worst unpaid change cost you are stored alongside it, and are used to decide what to build and what to charge.
To be removed, reply to the confirmation email and the address is deleted.
The daily backup
Once a day the waitlist is emailed to the operator address as a CSV, because it otherwise exists in exactly one place and a lost disk would lose it. That mail contains email addresses and the optional answers given alongside them. It contains nothing from the contract check.
Where it runs
The service runs on Railway. Email is sent through Resend. Those two see what they need to do their job and nothing more: Railway serves the pages, and Resend only ever sees the address a message is being sent to.
The honest caveat
The contract check is a review of wording. It looks for the presence or absence of specific kinds of clause. It does not know the law where you work, it cannot tell whether a clause is enforceable there, and it has no opinion on your particular situation. An agreement that scores twelve out of twelve can still be a bad agreement. Take a real contract to a real lawyer.