Privacy Policy

Who is responsible for your data

Demystif is a one-person product operated from Brazil for people in the United States. That makes us the controller of your data under Brazil's LGPD, and it is why this policy also exists in Portuguese. We honor the rights that US state privacy laws — including California's CCPA/CPRA — give you.

Need the formal identification of who is responsible — for a privacy request, a complaint to a regulator, or a legal notice? Ask at the address below and we will send you the details of who operates Demystif.

Data protection contact: [email protected]. A real person reads it.

The document you paste

When you paste a bill, an EOB, or a denial letter, the text is sent once to Anthropic's API, which reads it and returns the explanation. Under our commercial agreement with Anthropic, your text is not used to train their models.

On our side, the pasted text is never written to our database, never written to our logs, and never sent to analytics. It exists only in memory while your request is running. Our error messages are built from fixed text and numbers so that no part of your document can leak into a log line.

We do compute a fingerprint of the text and store that. Before it is stored, the text is hashed together with a secret value — the same treatment your IP address gets — which produces a SHA-256 code that cannot be turned back into your document. The secret is the part that matters: without it, anyone who could read our database could take a document they already have, run it through the same steps, and check whether it was analyzed here. The secret is not in the database, so that check does not work.

We use the fingerprint for one thing: if the exact same text is analyzed again within 24 hours, we reuse the analysis we already produced instead of paying to run the AI twice.

We do not accept file or photo uploads. Pasting text is the only way in, which is also the reason we hold no copies of your paperwork.

Pasting the document is your choice. You should know what saying no costs you: that text is the only way the service can work, so without it there is no analysis — and that is the whole consequence. Turning down analytics cookies changes nothing about what you get, and an account stays optional either way.

What we store, and why

• The analysis. The plain-English summary, the explanation of each charge, the red flags, the questions to ask, and — for each charge — a short quoted excerpt (up to 500 characters) of that line from your document. This is what you paid for and what the page and the emailed report show you.
• The fingerprint of the text (a SHA-256 code, hashed with a secret as described above), plus small numbers about the analysis: how many charge lines it had and how many red flags we found.
• Your email address, only if you type one, and only to send you the full report.
• Payment records:which payment provider was used, the provider's order reference, the amount, the currency, the status, and a log of status changes. Never card numbers — see below.
• Your cookie choices: the date and time, the choices themselves, the version of this policy you were shown, and a hashed version of your IP address. We keep this because we have to be able to prove what you agreed to. Each record is kept for 12 months and then deleted by the nightly job — see the retention section for why this one is not 30 days.
• Account data, only if you choose to sign in: your name, email address, and profile picture URL as your provider (Google or Facebook) gives them to us, plus the tokens that keep you signed in. The field-by-field list is in the next section.

Each of these three exists only because you asked us for something, and only until that request is finished:

• An email change waiting for your confirmation. If you ask to change the email address on your account, we hold the new address you typed and a fingerprint of the confirmation code — the code itself is only in the email we send to that new address. Your account keeps the old address until you open that link, so somebody signed in as you cannot move your account to their own inbox. One hour. The link stops working one hour after you ask for it. The request itself is deleted the moment you use it or cancel it, and otherwise by the nightly job on its first run after the hour is up.
• An account deletion waiting for your confirmation. When you ask us to delete your account, all we hold is a fingerprint of the confirmation code we emailed to the address already on the account. Nothing about your account changes until you open that link — and the email is also how you find out if the request was not yours. One hour. The link stops working one hour after you ask for it. The request itself is deleted the moment you use it or cancel it, and otherwise by the nightly job on its first run after the hour is up.
• A record of the changes made to your profile. One line each time your name, email address, or picture changes — including the lines we write when you confirm a deletion and those fields are blanked. Each line says which field changed and when. It does not keep the values: what it stores is a fingerprint of the old value and of the new one, each hashed together with a secret, so nobody can read your former name or former address out of this record. It is there so you can show what changed and when, which is the part that is on your side. It lasts exactly as long as the account does: when the nightly job removes the account row 30 days after you confirm the deletion, this history goes with it — including the lines written by the deletion itself.

Signing in with Google or Facebook: what we receive

An account is optional and never a prerequisite: pasting a bill, seeing the preview, and buying the report all work signed out. If you do choose to sign in, we use federated sign-in (OAuth) with Google or Facebook — we create no password, ask for no password, and never receive yours. What we keep comes from the provider:

• Name, email address, and profile picture URL. What the provider hands us about you when you authorize the sign-in. We store the picture as a link to the provider, not a copy of the image.
• Whether the provider says that email is verified. A date, set by the provider. We never send our own verification email.
• Which provider it was, and the id that provider uses for you (the OAuth `sub`). This pair is what recognizes you on the next sign-in. There is no password here: we never create one, never ask for one, and never receive yours.
• When that sign-in expired, and what we asked the provider for. A timestamp, the word the provider uses for the kind of token it issued, and the list of things we asked it for — usually your name and email. This is the record of what was authorized in your name.
• The tokens the provider issues to complete the sign-in — which we do not keep. These are credentials to your Google or Facebook account, not to ours. We use them to finish the sign-in and discard them in the same step, so those fields stay empty: nothing here ever calls the provider again on your behalf. They never reach your browser, never appear in a log line, and are never sent to analytics.

The session itself is a row in our database (an opaque id and an expiry date). The cookie in your browser carries only that id and is httpOnly, so page scripts cannot read it. What the application hands back to your browser about you is just id, name, email, and picture — the session id never leaves the cookie.

None of this is tied to the content of your document beyond the link between your account and the analyses you created while signed in, which is what lets you find them again. Deleting your account breaks that link and blanks your name, email, and picture — see the rights section.

How long we keep the analysis: 30 days

Every analysis is stamped with a deletion date 30 days after it is created. A job runs every night and empties every analysis past its date: the preview, the full report, and the delivery email address are erased, and the analysis is marked as deleted. Because the job runs nightly, the erase happens on the first nightly run after the 30-day mark, not to the minute.

What is left after that is a shell with no content in it: the record's id, its fingerprint, the counts, the dates, and the "deleted" mark. No summary, no charge lines, no quoted excerpts, no email address. We keep the shell so that a link that used to work can tell you honestly that the analysis expired instead of showing a bare error.

The shell does not stay forever either. 30 days after the analysis is emptied— 60 days after you created it — the same nightly job deletes the row itself, and the old link starts answering "not found" like any other dead link. If you were signed in, the entry drops off your list of analyses at that point too.

One exception, and it is the only one: if you paid for that report, the shell stays. The payment record points at it, and we have to keep proof of sales for accounting and tax purposes — a receipt whose subject no longer exists is not a record of anything. By then the shell holds no content, only the id, the fingerprint, the counts and the dates. It stays linked to your account so that the purchase keeps showing up as yours; deleting your account breaks that link, as the rights section explains.

Save or print anything you want to keep before the 30 days are up. We cannot restore a deleted analysis — that is the point of deleting it.

Payment records outlive the analysis. We have to keep proof of sales for accounting and tax purposes, so those rows stay after the content of the analysis they refer to is gone. They contain no health information.

Your cookie choices follow a different clock: we keep that record for 12 months, not 30 days. The reason is what the record is for. The analysis is kept to give you the service, so it goes when the service is done; the cookie record is kept to prove what you were asked and what you answered, and a complaint about cookies almost never arrives within a month. Twelve months is our own choice, not a deadline set by law, and we can revisit it. After that, the same nightly job deletes the record.

Who can open your analysis

Your analysis lives at a long, unguessable link. Anyone who has that link can read it, and we do not ask them to sign in — that is what makes the product work without an account. Treat the link like the bill itself: do not post it publicly, and be aware that forwarding it forwards the analysis. It stops working when the analysis is deleted.

Payments: Lemon Squeezy is the seller

When you buy the full report, Lemon Squeezy handles the sale as our Merchant of Record. In plain terms: they are the seller of record for that purchase. They take the payment, calculate and pay any sales tax, and issue your receipt. Your card statement will show Lemon Squeezy, not Demystif — that is expected, not a fraudulent charge.

The payment itself happens on Lemon Squeezy's own checkout page. Your card number never touches our servers, and we never see it. What comes back to us is a signed notification saying the order was paid, which is what unlocks your report. From that we store the order reference, the amount, and the status.

Lemon Squeezy handles your payment data under their own privacy policy and terms. Questions about a charge, a receipt, or a refund: [email protected].

Email delivery

If you give us an email address, we send the full report to it after payment, through Zoho ZeptoMail. The email contains the whole analysis, including the short quoted excerpts of your charge lines, so it is worth thinking about which inbox you use. We delete the stored address when the analysis is deleted; the copy sitting in your own inbox is yours to keep or delete.

Your IP address

Your raw IP address is never written to our database. Before it touches storage, we hash it together with a secret value, which produces a fingerprint we cannot reverse. We use that fingerprint to count free analyses per hour (kept in a temporary cache that expires within the hour) and to timestamp your cookie choices.

Cloudflare sits in front of the site and, like any network provider, processes your IP address to route and protect the traffic. Cloudflare Turnstile — the "are you human?" check on the form — also receives it, together with the challenge token, to decide whether the request is a bot. We run that check before calling the AI, because each analysis costs us money.

Cookies and browser storage

Necessary storage only, unless you allow more. Google Analytics loads only if you accept the analytics category, and when it does, it is configured to anonymize IP addresses. If you decline, no analytics script is loaded at all — it is not loaded and then switched off. We load no marketing or advertising scripts today, and we would need your consent to start.

One detail worth knowing: your cookie choice is not itself stored in a cookie. It lives in localStorage, which never travels with a request, so our server never sees it. The auditable record of your consent is the row we store on our side (date and time, the choices, the policy version, and a hashed version of your IP address).

Everything this site can leave in your browser, by category, purpose, and how long it lasts:

The sign-in cookies exist only if you sign in; an anonymous visitor gets none of them. To change your mind at any time, use Cookie preferences in the footer — turning analytics off expires the Google cookies right away. The companies behind these cookies are in the subprocessors list.

We never send the text of your bill, or any part of your analysis, to an analytics or advertising tool. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Subprocessors: the companies that process data for us

This is our public subprocessor list. It also has a page of its own, at demystif.com/subprocessors, which is the address to bookmark or pass along — same list, plus how you find out when it changes. Each name links to that company's own privacy policy. If one is added or removed, it changes in both places at once, and a change that matters becomes a new version of this policy.

Sending data out of the country

We are in Brazil, our servers are in Germany, and most of the companies above are in the United States, so your data does cross borders. The table says which company gets what, and where each one is; nothing leaves this site that is not in it.

For the document you paste, which is health information, what carries the transfer is your own decision to send it, after this page tells you it will be read by Anthropic in the United States and what for. Your account itself lives on servers in Germany, and Brazil's data protection authority has formally recognized the European Union as offering an adequate level of protection, so that leg rests on a public decision rather than on anything we had to arrange. For everything else — taking your payment, delivering your report — the transfer is carried by being necessary to do the very thing you asked us to do. Nothing crosses the border for a purpose of our own.

What this page does not claim: we accepted each of those companies' terms when we signed up, and terms like those usually carry a data protection agreement — but we have not gone provider by provider to confirm which document applies to us and since when. Until we have, this page will not tell you that a signed clause, a specific contract, or a certification is in place. Saying so without checking is the easy version, and it is the one nobody can verify.

If you want to know which agreement covers one of those companies, ask us: you get what we actually have, including the answer that we are still checking. The data protection address is [email protected].

Who is responsible for what

We are the controller of your data: we decide what is processed, why, and for how long, and we answer for all of it — including for what the companies above do on our behalf. Any request or complaint starts with us, at the data protection address; you do not have to chase any of them first.

Those companies are our processors: they handle data on our behalf and on our instructions, each one limited to the purpose in its row. None of them is authorized to use what it receives from us for its own purposes, and none of them is sent more than its row says.

One exception worth stating plainly: Lemon Squeezy is the seller of record, and for the payment details you give them on their checkout page they act as their own controller under their own privacy policy — we never see your card number and cannot delete what stays with them. The same goes for Google and Meta regarding your account with them: we receive the fields listed above, but the account is theirs and is managed there.

Your rights, and how to use them

You can ask us whether we hold anything about you at all, ask for a copy in a form you can take elsewhere, ask us to correct it, ask us to block or delete it, ask what we share and with whom, and take back your cookie consent whenever you want. You will never be treated worse for asking.

• See it, or get a copy. Signed in, the page Your data lists everything we hold about you in plain English, category by category, and says where each one came from. The same page links to a JSON file with the same records: your account, the sign-in providers you connected, how many devices are signed in, your analyses (id, status, dates), your payments and their status history, and your cookie-consent history. Neither one includes the analysis text itself — that stays on the analysis pages, which you can save or print — and neither one includes sign-in or session tokens, which are credentials.
• Delete your account. Signed in, you can ask us to delete it. We do not delete it on that click: we email the address on your account a confirmation link, which works once and stops working in one hour. That link is what protects you if someone else is signed in as you — and it is how you find out, because the email arrives even when the request was not yours. Nothing changes until you open it. When you do, all at once: your analyses are unlinked from you and their delivery email is cleared, your name, email address, and picture are blanked, your sign-in sessions stop working, and the account is marked as deleted. The row itself is physically removed by the nightly job 30 days later — a window that exists so a deletion made by mistake can still be sorted out and so we can meet record-keeping duties. Analyses already created keep running on their own 30-day clock; deleting your account does not delete them earlier. Your payment records stay for as long as tax and record-keeping rules require, with nothing left in them that points back to you.
• Change your cookie choices. Use the Cookie preferences link at the bottom of any page. It reopens the banner with your current choices. Turning analytics off removes the Google script from the page and expires its cookies right away; anything already sent before that stays with Google under their retention rules. We log every change, so the record shows when you said yes and when you took it back.
• Ask us directly. Email [email protected] for anything above, including if you never had an account. Tell us what you want; we may need to confirm you are the person the data is about.

Ask, and we answer within 15 days— the deadline the privacy law we operate under sets, and the one we apply to everyone, wherever you live. If you think we handled your data badly, you can complain to Brazil's data protection authority (ANPD) or to the privacy authority where you live.

Age: Demystif is for adults

You must be 18 or older to use Demystif. Our Terms of Use say the same thing, and so does the Portuguese version of this policy. One rule, everywhere.

This service is not directed to children — including in the sense of the U.S. Children's Online Privacy Protection Act (COPPA) — and it is not directed to teenagers either. We draw the line at 18, which is stricter than the line that law draws, for two reasons: what you paste here is health information, and we have no way for a parent to agree on a minor's behalf. Rather than promise a parental-consent step we have not built, we say plainly that the service is for adults.

Being exact about what that means: we do not ask your age and we do not check it, so this says who the service is for — it is not a verification we run. We do not knowingly collect data from anyone under 18. If you believe someone under 18 used Demystif, write to [email protected] and we will delete what we have. You do not need an account to ask.

One thing this rule is not about: whose bill it is. Adults handle paperwork for other people all the time — a parent, a partner, a child in their care — and our Terms allow that, as long as you are someone allowed to handle that document. The age rule is about who is using Demystif, and that has to be an adult.

Security and data breaches

Traffic is encrypted in transit (TLS), access to the database is limited to the application and the operator, payment notifications are verified with a signature before they can unlock anything, and no document text is written to logs.

No system is perfect. If there is a security incident that could put you at real risk, we will tell the people affected and the data protection authority, and we will say what happened, which data was involved, and what you can do about it. If you find a problem yourself, please tell us at [email protected] before telling anyone else.

Changes to this policy

This policy has a version number, shown at the top, and it is the version we record next to your cookie choices. If we change something that matters, we publish a new version and ask for consent again where consent is what allows the processing.