Privacy Policy
Native checks stay on your device. Online checks run on Numen's private Mac server and are deleted after processing.
Effective 25 August 2026.
Who we are
Numen Technologies Limited makes Slop or Not and is the data controller for the processing described here.
Numen Technologies Limited
Work Hub, 77 Camden Street
Dublin D02XE80
Ireland
Registered in Ireland with the Companies Registration Office, company number 677823.
For any privacy question or request, write to us at [email protected].
What this policy covers
This policy covers the slopornot.ai website, including the free online checker, and the Slop or Not app for iPhone, iPad, and Mac. The website and the app work differently, so they are described in separate sections below.
It does not cover other companies. If you follow a link from our site to somewhere else, that site runs under its own privacy policy, and we are not responsible for what it does with your data.
We publish this policy in several languages. The English version is the one that controls. If a translation and the English text disagree, the English text applies.
The Slop or Not app
The app checks text and images on your device. The content you check is not uploaded to us and is not sent to any other company for the check. The app never calls the online checker described below, so nothing you check in the app reaches our servers. There is no account to create and no sign-up.
The app's privacy manifest declares no collected data types, no tracking, and no tracking domains. It carries no analytics SDK and no crash-reporting SDK.
Detection models are downloaded from Apple as on-demand resources the first time you need them. Apple sees the model download the way it sees an app download. It does not see what you check.
The app can turn on iCloud sync for your check history and your daily check allowance. That data goes to your own iCloud private database and your iCloud key-value store, under your Apple Account. We have no key and no access to it. You can turn sync off in the app, and the app keeps the data locally instead. Deleting the data is done through the app and through your iCloud settings.
To check a photo, the app reads the image you pick from your photo library or your clipboard. It reads only what you hand it. Explicit-image blurring uses Apple's on-device Sensitive Content Analysis framework, which runs on your device and reports nothing to Apple or to us.
The app schedules reminders locally on your device, for example when your daily allowance resets. We do not run marketing push campaigns.
Purchases are handled by Apple through the App Store. We never see your payment details. Apple gives us anonymous sales and subscription reports, which do not identify you.
The free online checker
The online checker is different from the app, and we want that to be explicit. When you submit text or an image on the website, detection runs on a Mac we own and operate ourselves. No cloud AI vendor sees it. It is not used to train anything.
Your submission is written to disk only while the check is being performed, and it is deleted as soon as the check completes or fails permanently. At that same moment we also erase the request metadata described below.
- What you submit: the text or image you send, deleted after processing.
- Request metadata: your IP address, your browser user agent, and the approximate country, region, and city Cloudflare derives from your connection. We use it to run the checker, to enforce the daily allowance, and to spot abuse. It is erased when the check reaches its final state.
- Job record: a row holding the status and timings of the check, with the content and metadata already removed. It is deleted after 30 days.
- Result cache: a one-way HMAC fingerprint of the submitted content paired with the result, kept for 30 days so an identical resubmission returns instantly. The fingerprint cannot be turned back into your content.
- Failure cache: for images that fail deterministically, the same kind of fingerprint paired with the failure reason, kept for 24 hours so we do not burn your allowance twice on the same file.
- Daily allowance: one-way HMAC buckets derived from your IP address, and from your IP address together with your user agent. We never store the raw address. The buckets are kept for the UTC day they count and the day after, then deleted.
The checker is protected by Cloudflare Turnstile, so Cloudflare receives the connection data it needs to tell a person from a bot. Turnstile is a security measure, not an advertising product.
A result from the checker is an estimate. It is not proof of who wrote or made something, and accuracy varies with new models and with methods built to defeat detectors.
The contact and support form
If you write to us through the form on the site, you send us your name, your email address, your message, and an optional screenshot. If you tick the anonymous option, your email address is stripped before the message leaves our server, and we have no way to reply.
We do not store form submissions. The message is relayed to our mailbox by Mailgun, our email provider, and it then lives in our mail account for as long as we need it to answer you. Attached images are re-encoded and stripped of their metadata before they are sent on.
The form is protected by Cloudflare Turnstile and by a per-IP rate limit.
When you report a problem from a check result, the site puts a summary of the result — the check type, the verdict, and the confidence percentages — into your browser session storage under numen:report-payload so the form can prefill it. The form clears it when it reads it, and ignores and clears anything older than ten minutes; if you never open the form, the entry stays until you close the tab. It never leaves your browser until you press send.
Analytics
We measure how the site is used with Umami, which we host ourselves on our own infrastructure and serve from our own domain. There is no Google Analytics, no tag manager, and no advertising pixel anywhere on this site.
Umami sets no cookies and builds no cross-site profile. It records page paths, the query string an inbound link carries (including campaign tags and advertising click IDs), referrers, your browser, operating system, device type, screen size, browser language, and an approximate location down to city level, derived from your IP address. It also records named events such as a button click. Events carry no text or images you have checked.
Your IP address is processed transiently to derive that approximate location and the daily-salted hash that groups a visit. It is not stored.
The legal basis is our legitimate interest in understanding how our own site performs. We weighed that against your interests and concluded it is proportionate: the measurement is first-party, cookieless, content-free, confined to this one site, and never shared with an advertising network.
Error reports
When something breaks, the site can send an error report to Glitchtip, which we also host ourselves. The report describes the failure so we can fix it.
Before a browser error report is stored, query strings are stripped from URLs and identifiers are removed. The legal basis is our legitimate interest in keeping the service working.
The same Glitchtip instance also receives performance measurements: ordinary page loads and requests are timed and sent there even when nothing breaks, scrubbed the same way. We use those measurements only to keep the service fast and working, on the same legal basis and with the same handling as the error reports.
Cookies and browser storage
The table below is the complete list. There is no consent banner on this site because there is nothing here that needs consent: the locale cookie only remembers which language to serve you, the analytics are cookieless and first-party, and Turnstile and Cloudflare's cf_clearance challenge cookie are security measures that protect the site rather than track you. We do not embed third-party video or social widgets on this site. If we ever do, the embed will not load until you click it.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| NEXT_LOCALE | First-party cookie | Remembers which language the site should serve you, so later visits land in the same one. Strictly necessary for delivering the site in that language. | Until you close the browser |
| theme | First-party local storage | Remembers whether you chose the light or the dark theme. | Until you clear it |
| numen:report-payload | First-party session storage | Carries a summary of the result — the check type, the verdict, and the confidence percentages — into the report form when you report a problem with a result. | Until the form reads it, or until you close the tab; ignored after ten minutes |
| Cloudflare Turnstile | Third-party security challenge | Tells a person from a bot on the checker and the contact form. | Per challenge, set by Cloudflare |
| cf_clearance | Cookie, set by Cloudflare | Appears only if Cloudflare has to challenge suspicious traffic, so that a visitor who passes the challenge is not asked again. It protects the site; it does not track you. On an ordinary visit it is never set. | Short-lived, set by Cloudflare |
Why we process data, and on what legal basis
| What we do | Data involved | Legal basis (GDPR) |
|---|---|---|
| Run a check you asked for on the online checker | Submitted text or image, IP address, user agent, approximate location | Article 6(1)(b), taking steps at your request |
| Enforce the daily allowance and keep the checker available | One-way HMAC buckets derived from IP address and user agent | Article 6(1)(f), our legitimate interest in a free service that survives abuse |
| Block bots on the checker and the contact form | Connection data processed by Cloudflare Turnstile | Article 6(1)(f), our legitimate interest in security |
| Answer a message you sent us | Name, email address, message, optional screenshot | Article 6(1)(b) and Article 6(1)(f), answering your request |
| Measure how the site is used | Cookieless, content-free page and event data | Article 6(1)(f), our legitimate interest in improving our own site |
| Diagnose errors | Error reports and performance measurements with query strings stripped from URLs and identifiers removed | Article 6(1)(f), our legitimate interest in a working service |
| Meet legal obligations, including accounting and tax | Records Apple and our accountants require | Article 6(1)(c), legal obligation |
Who else is involved
We keep as much as possible in our own hands. Our analytics, our error tracking, our database, and the Mac that runs detection are all operated by us, not bought as a service, so they are not third parties receiving your data.
These companies do process data on our behalf:
- DigitalOcean - hosting for our servers.
- Cloudflare - DNS, TLS, content delivery, Turnstile, and encrypted backup storage.
- Mailgun - delivery of messages sent through the contact form.
- Apple - the App Store, purchases, iCloud sync of your own data, and delivery of the detection models.
- Tailscale - the private network our machines talk to each other over. It carries traffic; it does not read it.
We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it to train AI models. We disclose data to a public authority only where the law requires it.
How long we keep things
The specific periods for the online checker are listed in the section above. In summary:
- Submitted content: deleted as soon as the check finishes.
- IP address, user agent, and approximate location for a check: erased at the same moment.
- Check job records: 30 days.
- Result fingerprints: 30 days. Image failure fingerprints: 24 hours.
- Daily allowance buckets: kept for the UTC day they cover and the day after, then deleted.
- Analytics: kept indefinitely as event records. Umami groups a visit using a hash that is re-salted every day, so there is no identifier that follows you from one day to the next, and the IP address the hash is derived from is not stored. Where an inbound link carried an advertising click ID, that ID stays part of the recorded URL.
- Contact form messages: kept in our mailbox for as long as we need them to deal with your request.
Our servers are backed up nightly to encrypted storage at Cloudflare R2, and those backups are kept for up to about six months. Content submitted to the checker is excluded from the backups. A job record can appear in a backup snapshot taken during its own 30-day life, and will age out of the backups after that.
International transfers
We are an Irish company. The cloud servers that run this site and its APIs are hosted in European Union datacenters, in Amsterdam. Some of the providers listed above are established in the United States and may process data there or in other countries.
The safeguard for each transfer depends on that provider's current arrangement. We are verifying the applicable Chapter V mechanism with legal counsel and will update this policy after that review. Contact us if you need the current details for a particular provider.
Security
Traffic to the site is encrypted in transit. Our machines talk to each other over a private network. Backups are encrypted. Access to production systems is limited to the people who need it.
No system is perfect, and we will not pretend otherwise. If we ever suffer a breach that puts your rights at risk, we will notify the Irish Data Protection Commission and, where the law requires it, you.
Children
Slop or Not is a general-audience product. It is not directed at children, and we do not knowingly collect personal data from children. If you think a child has sent us personal data through the contact form, write to [email protected] and we will delete it.
Changes to this policy
We update this policy when what we do changes. The effective date at the top always tells you which version you are reading. We keep a full revision history of this page, and we will share the relevant changes on request.
Your rights
Which rights you have depends on where you live. To exercise any of them, write to [email protected]. We answer within the time the applicable law allows, and there is no charge. We may ask you for enough information to be sure the request is really yours, and no more.
One honest limitation: most of what we hold about a check is deleted within seconds of the check ending, or is a one-way fingerprint we cannot reverse. If we cannot find data that identifies you, we will tell you so rather than invent a match.
European Union and European Economic Area (GDPR)
You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing that already happened.
Where we rely on legitimate interests, you can object on grounds relating to your particular situation, and we will stop unless we have compelling grounds that override yours.
Our lead supervisory authority is the Irish Data Protection Commission. You can complain to it, or to the authority in the country where you live. The list of national authorities is published by the European Data Protection Board.
United Kingdom (UK GDPR and Data Protection Act 2018)
You have the same set of rights described above. You can complain to the Information Commissioner's Office at ico.org.uk.
United States state privacy rights
If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you may have the right to know what personal information we collect, to get a copy of it, to have it deleted, to correct it, and not to be treated worse for exercising those rights. Not every right exists in every state.
We do not sell personal information and we do not share it for cross-context behavioral advertising, in any state, for any price. Because there is no sale or sharing to stop, a Global Privacy Control signal has nothing here to opt you out of. We do not use sensitive personal information for inferring characteristics.
To exercise a state right, write to [email protected]. If we cannot verify a request, we will say so and explain why.
Canada (PIPEDA)
You can ask what personal information we hold about you, how we use it, and who we disclose it to, and you can ask us to correct it. You can complain to the Office of the Privacy Commissioner of Canada.
If you are in Quebec, Law 25 gives you further rights, including rights around automated decisions and data portability. We do not make automated decisions that produce legal effects about you.
Brazil (LGPD)
You have the right to confirmation of processing, access, correction, anonymization or deletion of unnecessary data, portability, information about with whom we share data, and revocation of consent. You can complain to the Autoridade Nacional de Proteção de Dados.
India (Digital Personal Data Protection Act 2023)
You have the right to access a summary of your personal data and our processing, to correction and erasure, to nominate someone to exercise your rights if you die or become incapacitated, and to a grievance route. Send grievances to [email protected], which is our contact point for this purpose.
Australia (Privacy Act 1988 and the APPs)
You can ask for access to the personal information we hold about you and ask us to correct it. If you are unhappy with how we handled a privacy matter, complain to us first at [email protected]. If our answer does not satisfy you, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.
Contact us
Privacy questions, requests, and complaints all go to the same address: [email protected]
The terms that govern your use of this site are in our Terms of Use.