Privacy Policy

Overview

DiffALL ("the Service") tries to collect the minimum it needs to work. Comparing or checking files does not require an account: files you upload are processed and deleted, and if you never sign in, the only data anywhere is in your own browser's localStorage.

Creating an account changes that: we then store your email address, plan, credit balance, and a record of your comparisons and quality checks (not the files themselves — see Section 3) so the Service can function across devices and sessions. Section 1 lists exactly what, in both cases.

We also use a handful of third-party services — analytics, payment processing, error monitoring, sign-in, and email delivery — each named in Section 6, along with what it sees.

This policy explains honestly what data exists, where it lives, and how it is used.

1. What We Collect

A. In your browser (always, whether or not you have an account). Saved to your device's localStorage, never sent to us:

• diffall_plan — Your current plan as last known to this browser (e.g., "free" or "premium").
• diffall_credits — Your remaining comparison credits as last known to this browser.
• diffall_history — Up to 5 recent comparisons: similarity score, file type, the file names you provided, and a timestamp.
• diffall_cookie_accepted — Whether you accepted or have not yet answered the cookie banner. Google Analytics (Section 4) is not loaded until this is "accepted".

You can clear all of this by clearing this site's localStorage (Developer Tools → Application → Local Storage → Delete All).

B. On our server, only if you create an account. Using the Service anonymously (no sign-in) never creates any of this:

• Email address — from Google, if you sign in with Google, or the address you register with directly.
• Account state — your plan, credit balance, and (for a Pro subscription) renewal date.
• A record of each comparison, quality check or AI check you run — timestamp, media type (video/audio/image/etc.), the files' durations and sizes, the result (a similarity score, a quality band, or the AI check's number and verdict), and an error message if it failed. Not the files' content or names — see Section 3.
• API keys, if you create one for programmatic access — we store a cryptographic hash of the key, not the key itself; we cannot recover it if you lose it.
• Promo code redemptions — which code, and when, tied to your account, so a code can't be reused.
• Funnel events, if you're signed in — which stage of the upgrade/checkout flow you reached (e.g., the upgrade prompt was shown, checkout was opened), used in aggregate to understand where people get stuck, not to build an individual profile.

C. Anything you choose to send us, signed in or not.

• The feedback form — your message, its category and the help topic you were reading, plus your account email if you are signed in, or an email address you choose to give us if you are not. That address is used only to reply to you. The message text is sent to MyMemory (a translation service run by Translated) so it can be read in the site owner's language; no address or account detail goes with it.
• "Was this report right?" under a quality report — your vote, an optional comment, and the report's own bands and scores, so we can see which check got it wrong. Not the file, its name, or your IP address; your account is attached only if you are signed in.
• "Do you know whether it was made with AI?" under an AI check — your answer, an optional comment, and the result's own number, verdict and model estimate, so we can measure how often the check is right. Not the file, its name, or your IP address; your account is attached only if you are signed in. Reading a file's Content Credentials never contacts any other service.
• "Were these actually the same person?" under a voice comparison — your answer, an optional comment, and the result's own verdict, voiceprint similarity and seconds of speech, so we can measure how often voice comparison is right. Not the recordings, their names, or your IP address; your account is attached only if you are signed in.

2. Payments

Purchases (the credit pack or a Pro subscription) are handled entirely by Lemon Squeezy, our payment processor — you're taken to their checkout page, and we never see or store your card number or billing address. Lemon Squeezy tells us, via a server-to-server notification, only: your account (so we know whose plan to update), what you bought, and that it was paid. See Lemon Squeezy's own privacy policy for what they collect to process the payment itself.

3. Uploaded Files

Files you upload are sent to the server only to compute the comparison or quality metrics you asked for. They are:

• Saved temporarily to the server's temporary storage during processing.
• Deleted automatically afterward — untokened uploads within 2 hours; the browser-playable copies behind DiffALL's Live Comparison feature, which you may return to later, within 24 hours.
• Never logged and never shared with any third party.

What is kept, and only if you're signed in, is the small comparison record described in Section 1B — file sizes and durations, not content, and not the file names, which is why history in your browser (Section 1A) carries file names but your account's server-side record does not.

We strongly recommend not uploading files containing sensitive personal information, private media, or confidential content.

4. Google Analytics

The Service uses Google Analytics 4 to measure aggregate usage — total visitors, country (from IP), browser type, referrer, pages visited, and time on site. IP addresses are anonymised (the last octet is dropped before storage) and we never see your IP in raw form.

Google Analytics is not loaded at all until you accept the cookie banner shown on your first visit — declining, or leaving it unanswered, means no Google Analytics script runs and no request reaches Google. Once accepted, it may set first-party cookies (typically _ga, _ga_*) to count returning visitors; these do not contain personal information.

To opt out even after accepting: install the official Google Analytics Opt-out Browser Add-on, use a privacy-blocking extension (uBlock Origin, Ghostery, Privacy Badger), or browse in private/incognito mode.

Our own page counter

Separately from Google Analytics, our server keeps a counter of how many times each page was viewed, grouped by day and by one of five broad referrer categories (direct, search engine, AI assistant, another site, or a link from within DiffALL). It exists because analytics that depend on a consent banner, an ad blocker and a third party being reachable cannot tell us how many people the site is actually serving.

This counter stores a number, and nothing about you: no cookie, no identifier, no IP address, no session, no row per visitor, and nothing that could be traced back to a person or linked between visits. A page view from you and a page view from anyone else are indistinguishable — both simply add one to the same integer. Because it holds no personal data, it does not depend on the cookie banner and there is nothing in it to opt out of, request a copy of, or delete. The referring site is reduced to one of those five categories and the specific address is never stored.

5. Error Monitoring

We use Sentry to catch and diagnose bugs, both in your browser and on our server. When something breaks, Sentry receives a technical error report — what failed and where in the code, your browser type, and the page URL. It is not used for tracking, advertising, or analytics, and we configure it to avoid capturing file contents or full request bodies. See Sentry's privacy policy.

6. Third-Party Services

• Supabase — our backend database and authentication provider. It stores everything in Section 1B and enforces who can read it. See Supabase's privacy policy.
• Google Sign-In (OAuth) — if you choose "Continue with Google", Google authenticates you and shares your email address with us; we never see your Google password.
• Resend — delivers the sign-in emails (one-time codes / magic links) Supabase sends on our behalf. It sees the email address a message is sent to and the message content, nothing more.
• Lemon Squeezy — see Section 2.
• Chart.js, loaded from cdn.jsdelivr.net, to render the per-second similarity chart — a static-asset CDN; loading it may expose your IP to jsDelivr's infrastructure.
• The site's typeface is served by us, not by Google. Until 24 September 2026 the Inter typeface was loaded from fonts.googleapis.com, which sent your IP address to Google on every page load, before and regardless of the cookie banner. It is now served from this site's own servers, so no request for it reaches Google and no IP address is disclosed to anyone for it. The font files are used under the SIL Open Font License 1.1; a copy of that licence travels with them, at /static/fonts/OFL.txt.

No advertising networks or social media tracking SDKs are used.

7. Cookies

The Service itself does not set HTTP cookies — your session (if signed in) is kept in your browser's localStorage, not a cookie. Google Analytics may set first-party cookies as described in Section 4, but only after you accept the cookie banner. Lemon Squeezy's checkout page (Section 2) is on their own domain and may set its own cookies there, governed by their policy, not this one.

8. Data Retention

Uploaded files: per Section 3. Account data (Section 1B): kept for as long as your account exists. Anonymous usage: we keep a salted, one-way hash of your IP address (never the IP itself) to enforce the daily free-comparison limit; it cannot be reversed back into an IP address and is not linked to any account.

9. Your Rights

If you have an account, you can request a copy of the data in Section 1B, ask us to correct it, or ask us to delete your account and everything tied to it, by contacting us (Section 12). We aim to respond within 30 days. If you never created an account, there is nothing on our servers tied to you to begin with — Section 1A covers everything, and it's already entirely in your own browser.

10. Children's Privacy

This Service is not directed at children under 13 years of age. We do not knowingly collect information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the Service after a policy change constitutes your acceptance of the revised policy.

12. Contact

DiffALL is operated by an individual, not a registered company, from Israel. Questions about this Privacy Policy, or a request under Section 9, can be sent to lucynight.studio@gmail.com.