Privacy policy

1. Who processes your data

GLOBAL HUMAN INTELLIGENCE CONSULTING, a French entreprise unipersonnelle à responsabilité limitée (EURL) registered under SIREN 939 603 593, with its registered office at 60 rue François 1er, 75008 Paris, France. VAT number FR06939603593.

Contact for privacy questions: contact@quietmeta.app.

Who else touches anything, and what exactly

Who	What they receive	Why
Google Cloud EMEA Limited europe-west1, Belgium	Everything this site serves, in transit. Our counters and settings, at rest.	Hosting and storage
Stripe Payments Europe, Ltd. Ireland	Your card details, entered on their page. Your email and billing address.	Taking payment
Sendinblue SAS, trading as Brevo France	The email address of a buyer, and the licence key or sign-in link sent to it.	Delivering the licence and subscriber sign-in links by email
X.AI LLC United States	The text you submit for rewriting. Nothing else: no name, no email address, no identifier, no IP address.	Rewriting a text

Only the last of these ever receives content you wrote, it is the only feature that sends anything outside our own infrastructure, and it does nothing until you ask it to. Everything else on this site — inspecting a file, removing metadata, cleaning invisible characters — involves none of them beyond hosting.

The transfer to X.AI LLC leaves the European Union. It rests on the standard contractual clauses of their terms, and on the fact that what is sent carries no identifier we could attach to you. If that transfer is not acceptable to you, do not use the rewriting feature: nothing else on this site performs one.

2. What happens to a file you inspect

When you drop a file into the web version, its bytes are sent to our processing service, held in memory for the duration of that single request, analysed, and released. They are never written to a database, an object store, a queue, a cache or a backup. When you clean a file, the result is streamed straight back to your browser and is never stored on our side either.

We say "not retained" rather than "nothing is stored", because that is the accurate claim. A managed hosting platform, an operating system or a memory allocator can hold transient copies outside our control. What we can state precisely is that our application persists nothing.

3. What we never record

The following never enter our logs, metrics or any other store:

• the content of your files, or any extract of it;
• file names and file paths;
• thumbnails or previews;
• any fingerprint or hash of your content;
• the metadata values we read out for you — GPS coordinates, device names, author names, provenance details;
• the text sent for rewriting by the desktop application, in either of the two modes described in section 8, and no fragment or hash of it either;
• your IP address inside our application logs.

This is enforced in code rather than by policy: the logger carries an explicit allowlist, and any field outside it is dropped before it can be written.

4. What we do record

For each operation we keep a small technical event containing only: a random identifier, whether it was an analysis or a cleaning, a broad format family (for example "jpeg"), a size band rather than an exact size, a latency band, the outcome code, and the engine and policy versions.

Nothing in that event can be traced back to you or reconstructed into your file. Its purpose is to know whether the service works, not who used it.

5. Usage counts

We keep daily totals so we can tell which parts of the site are useful: how many times each page was served, how many files were analysed or cleaned in each format family, and how many purchases went through. These are sums, and a sum cannot be taken apart again.

We also count where arrivals come from. When your browser tells us which site linked to us, we keep the domain name only — "google", "reddit", an ordinary domain — and discard the rest of the address. A search engine puts what you typed into that address; we never store it, and a literal IP address is never kept either. If your browser sends nothing, the arrival is counted as "direct".

There is no analytics service on this site, no tracking pixel and no measurement cookie. We do not assign you an identifier, we do not fingerprint your browser, and we do not store your IP address. Because of that, we cannot tell whether two visits come from one person or from two, and we have no way to follow anyone from one page to the next.

The text cleaner is a special case worth stating plainly: it runs entirely inside your browser, so we count visits to that page and nothing else. We do not know how much text you cleaned, or that you cleaned any at all.

6. Hosting

The web version runs on Google Cloud Run in the europe-west1 (Belgium) region. Google acts as a processor on our behalf under its data processing addendum. Standard infrastructure request logs, which may include IP address and user agent, are managed by that platform; they are separate from our application logs and are retained for 30 days, the default retention of Google Cloud Logging, after which Google deletes them. We do not extend that period and we do not copy those logs anywhere.

7. Advertising

When advertising is enabled, the web version displays a banner served by Google AdSense. Google may then set cookies or read device identifiers to select and measure advertising, under its own privacy policy and independently of us. We do not send Google anything about your files. The desktop application contains no advertising and no tracking of any kind.

Nothing loads before you say so. If advertising is switched on, a banner asks first. Until you accept, the Google script is not sent to your browser at all — it is not merely hidden — and this page's content security policy stays locked to our own origin, so nothing third-party can load even by accident. Refusing takes one click, exactly like accepting, and we do not ask again for six months.

The cookie recording your answer is strictly necessary: it exists so that a refusal is respected. It holds one word, accepted or refused, and nothing else.

8. The desktop application

The desktop application reads and cleans your files entirely on your own machine. It contains no telemetry, no analytics and no update checker, and outbound network requests are blocked at the process level. It sends us nothing, ever — including when it crashes. Nothing in this section changes if you never touch the feature described next.

One feature uses the internet, and only when you ask it to. The Rewrite screen sends the text you type into it to xAI, so that the wording can be chosen again, and sends back the result. It is switched off until you switch it on; it never sends a file; and it opens the network only for the duration of a rewrite you asked for. It has two modes, and they do not send your text along the same path. Which one is in use is shown on the screen itself, before you press the button.

Included words, the mode a new licence starts in. Your licence comes with 50,000 words of rewriting paid for by us. In this mode your text is sent to our server at quietmeta.app, which forwards it to xAI using our own API key and sends the result back to you. Your text therefore passes through us. We do not store it, we do not log it, and we do not keep the result: it lives in the memory of one request and is gone when that request ends. Nothing about the text — not its content, not a fragment of it, not a hash of it — is written to any log or any database. What we do keep is one record per licence: the licence identifier that came with your purchase, and a running total of words rewritten, so that we know when the 50,000 are used up. That record holds no name, no email address and no IP address, and it cannot tell us what you rewrote. We also keep a daily total of words across all licences, which is a spending cap and carries no identifier at all.

Your own key. If you put your own xAI API key into the screen, the request goes from your computer straight to xAI and never passes through us. In that mode we see nothing at all — not the text, not the key, not the fact that a rewrite happened — and xAI bills you directly. The application switches to this mode when the included words run out, and it says so rather than switching quietly.

In both modes, what xAI does with a text once it arrives is covered by xAI's own terms and privacy policy. In the included mode the account at xAI is ours; in the other mode it is yours.

Your own key, if you enter one, is stored in a single file in the application's data folder on your computer, encrypted for your Windows account, and it is never sent to us or shown back to the interface. It is not removed when you uninstall the application: you can delete it at any time from the same screen, with Delete the key from this computer.

9. Subscriber accounts

The rewriting subscription is the only part of QuietMeta that has accounts, and an account exists only after a payment has gone through. There is no free account, no trial account and no newsletter signup: the sequence is Stripe Checkout, then Stripe confirms the payment to us, then the account is created from that confirmation. If you close the payment page, nothing about you was ever stored on our side.

An account record contains exactly this, and nothing else:

• the email address you gave at payment;
• the Stripe customer and subscription identifiers;
• the subscription status Stripe reports (active, past due, cancelled);
• the day of the month your subscription started, which sets when your monthly word counter resets;
• a counter of words rewritten in the current period.

What it deliberately does not contain: no password, no name, no IP address, no text you rewrote, no history of rewrites, no timestamps of your visits. The counter answers "how many words"; it cannot answer "which words" or "when".

Signing in works without a password. You ask for a sign-in link, we email it to the address on the subscription, and opening it sets a signed session cookie. That cookie is strictly necessary — it is what "being signed in" means — and it holds no personal data, only a signed reference to your account. Sign-in links expire after thirty minutes and work once. If Google sign-in is enabled and you choose it, Google tells us the verified email address of your Google account so we can match it to your subscription; we store nothing new from Google, and we never see your Google password.

Deleting the account. Cancel the subscription at any time from the account page; it then runs until the end of the period already paid. Once the subscription has ended, write to the address in section 1 and we delete the account record. Invoices and payment records stay with Stripe for as long as accounting law requires; that retention is theirs, not ours.

10. Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Unless you hold a rewriting subscription, we hold almost nothing about you: no account, no email address, no content. If you do, we hold the fields listed in section 9 and nothing else. Requests can be sent to the address in section 1, and you may lodge a complaint with the CNIL.

11. Changes

This policy is written and maintained by the publisher and has not been reviewed by a lawyer. We would rather say so than let you assume otherwise. It describes what the software actually does, and it is updated whenever that changes — the usage counts in section 5 were added on 14 August 2026, and the AI rewriting feature described in section 8 on 16 August 2026. Section 8 was rewritten the same day, when rewriting gained a second mode in which the text passes through our server: the earlier wording said it never did, and that had stopped being true. Section 9 was added on 17 August 2026, when the rewriting subscription introduced the first accounts this product has ever had — and the sentence "we do not have an account system" was removed the same day, before the code existed, rather than after.