Privacy Policy

BunnyLabs LLC, a Wyoming limited liability company, operates TurnitPass and is responsible for the personal information described in this Policy. This Policy covers website visits, sign-in, writing and citation tools, API use, purchases and support. "We", "us" and "our" mean BunnyLabs LLC. For privacy questions or requests, contact [email protected].

This Policy explains processing practices; it is not a request for blanket consent to every processing activity. Where consent is required for a particular purpose, it must be obtained separately.

When you sign in with Google, we receive account identifiers and basic profile information such as your name, email address and profile image. Supabase supports authentication and stores account data, including subscription status, word balances and associated identifiers.

Stripe handles checkout and subscription payments. We receive customer and subscription identifiers, plan details, payment status and transaction information needed to deliver access, reconcile charges and manage billing. We do not store your full payment-card number. Stripe and your payment provider handle payment information under their own applicable privacy notices.

When you contact us, we collect your email address, subject, message and related troubleshooting information. Contact submissions can also include your IP address and browser information for security and abuse handling.

We process text you submit, processing settings, generated rewrites, detection results and source information needed to perform the requested task. Document workflows can include extracted text, file name, file type and extraction warnings. Citation lookups may send a DOI, URL or other query to publication-metadata services or the relevant source website.

Using a tool sends the necessary input to our servers and to the applicable AI, language-model, translation or detection providers for that feature. Text processing is not entirely on your device. Avoid submitting passwords, payment-card details, sensitive personal information or confidential third-party material that you are not authorized to share.

We keep records of completed rewriting requests that can include the original text, result, language, mode and word count. Detection records can include the submitted text, score and label. These records are distinct from the browser-history feature and are associated with your account where applicable.

We also process API-key metadata, request identifiers, endpoint and status information, timestamps, usage counts and technical logs to meter access, investigate failures, prevent abuse and reconcile billing. For invitation abuse prevention, we record account-linked IP addresses, a first-party browser identifier and a hash of browser and device signals. A shared IP alone does not disqualify an invitation.

The unified History feature stores compressed copies of inputs, outputs, tool settings and related result details in local browser storage. It can keep up to 1,000 records, subject to record size and available browser storage. Compression reduces space; it is not encryption. The feature does not synchronize those local records to another browser or device.

Local history is separated by account identifier and guest scope within the browser, but signing out does not erase those records. People with access to the same browser profile or device may be able to access its stored data. Use care on shared devices.

You can remove individual records, clear local history or export a readable backup through History. Clearing site data or losing access to your browser can remove this local copy. Deleting local history does not delete server-side request records, billing records or provider-held data. For server-side deletion requests, contact support.

We use information to authenticate accounts, perform requested processing, provide results, manage subscriptions and word allowances, support users and maintain reliable service. Where applicable data-protection law requires a legal basis, these activities rely on performance of our contract or steps you request before entering a contract.

We use necessary security, diagnostic and usage information to enforce our agreements, detect fraud, investigate abuse, protect our rights, and improve service reliability and product quality. Where applicable, this relies on legitimate interests balanced against individual rights. We process legally required accounting and other records to comply with law; optional processing that requires consent will rely on that consent.

TurnitPass does not use your submissions to train its own models. When a feature relies on a third-party provider, that provider receives the input needed to return a result, and how it handles that input depends on the provider and the feature you use.

Service providers receive information needed for their roles: Google for sign-in; Supabase for authentication and database services; Stripe for billing; Vercel for hosting and request delivery; and AI-processing, detection and publication-metadata providers for the tools you use. A particular request uses the providers relevant to that feature.

We may also disclose information when required by law or valid legal process, to investigate fraud or protect rights and safety, to professional advisers as needed, or in a business transfer subject to applicable data-protection duties. We may share information at your direction. We do not sell your submitted drafts or personal information.

Independent websites and services you choose to use have their own privacy practices. Links or integrations do not make their entire operations part of TurnitPass.

Authentication cookies and browser storage support sign-in, session security, language preferences, editor handoff and local history. A first-party device cookie and a browser-signal hash help detect repeated or abusive invitation registrations; they are not advertising identifiers. Browser settings can remove or block these technologies, but doing so can sign you out or remove drafts and history.

The current website does not embed advertising trackers or a third-party marketing-analytics SDK. This does not eliminate operational logs collected by hosting, authentication or payment systems. If optional tracking is introduced, we will update this notice and obtain consent where applicable before using it.

Local history remains in its browser until you delete it, browser storage is cleared or evicted, or applicable storage limits prevent saving. Exported files remain wherever you choose to save them. Account deletion does not remotely erase copies on your devices.

Server-side account, processing and usage records are retained while they are needed to provide the account and service, address support or security issues, and reconcile usage. Retention follows need rather than a single fixed period, so different record types are kept for different lengths of time. You can request deletion of your server-side records at any time through support.

After a verified deletion request, we will delete or de-identify information that is no longer required, subject to applicable law. Billing, tax, fraud-prevention and dispute records may need to be retained for the legally required or necessary period. Restricted backup copies may remain until the relevant backup lifecycle ends. These criteria, rather than a universal number of days, determine retention across different record types.

TurnitPass serves users internationally. Hosting, account storage, payment processing and AI services may process information outside your country, including in Singapore, the United States and other locations where relevant providers operate. Those countries may have different data-protection rules.

Where applicable law requires a transfer safeguard, the relevant transfer must use an approved mechanism or other lawful basis, such as applicable contractual safeguards. Contact support for information about the transfers and safeguards relevant to your data.

We use HTTPS and access controls to protect data in transit and restrict access to account and service records. No service or browser storage is completely secure. Local-history compression is not a security boundary, and downloaded exports are readable by anyone with access to the file.

Protect your Google account, devices and API keys. Do not include passwords or complete payment details in support messages. Let us know promptly if you suspect unauthorized access.

Depending on applicable law, you may request access to, correction of, deletion of or a portable copy of your personal information, object to or restrict processing, and withdraw consent where processing relies on consent. You may also complain to the relevant data-protection authority. These rights have legal conditions and exceptions.

Email [email protected] from your account email, describe the request and distinguish local browser records from server records where possible. We may verify your identity using proportionate information and will respond within the period required by applicable law. Do not send identity documents unless specifically needed and requested through an appropriate channel.

If applicable California privacy law covers your relationship with us, you may have rights to know, access, correct and delete personal information, and opt out of its sale or sharing for cross-context behavioral advertising. We do not sell personal information or share it for that advertising purpose. We do not penalize you for exercising applicable privacy rights.

The Service is not directed to children under 16 or a higher minimum age required locally. If you believe a child has submitted personal information without the necessary authorization, contact us so we can investigate and take appropriate deletion or access-restriction measures.

We will update the effective date when this Policy changes and provide appropriate notice of material changes before introducing materially different processing, obtaining consent where required. For privacy questions, deletion requests or complaints, contact [email protected].