Privacy policy
Last updated 12 November 2026
RevokeGPT is a bot protection service. This policy explains what we collect in two roles: when we protect our customers' websites and apps (where we act for our customer, as their processor), and when you use revokegpt.com or our dashboard (where we decide how your data is used, as controller).
The short version
- We set no cookies on visitors of the sites we protect, and none on this website.
- We do not store IP addresses, user agents or raw browser measurements from a check.
- We do not sell data, build advertising profiles or follow people across sites.
- Check logs are kept for 31 days, then deleted.
1. Visitors of sites that use RevokeGPT
When you use a form protected by RevokeGPT, a small script in your browser solves a proof-of-work puzzle and measures how the browser behaves. Our servers use this, with the network the request comes from, to produce a risk score for the site you are using. We then keep only:
- a short code derived from your network, which changes for every site and every month and cannot be reversed;
- a network type (for example home, company, mobile, VPN or cloud server);
- a few yes-or-no results about your browser, the score and the reasons for it.
These records are kept for 31 days. Monthly totals that identify no one are kept for up to 13 months. We also use these records, in a form that identifies no one, to improve our detection of automated abuse. The site you are using is responsible for telling you that it uses RevokeGPT and for its legal basis, usually its legitimate interest in keeping its service secure.
Optional account features
Some sites also turn on these features. If they do, the following applies:
- Account protection. The site tells us which account a sign-in or sign-up belongs to, as an identifier we turn into a keyed code unique to that site. We keep it with similar codes for the device, country and network for up to 90 days after the last sign-in (30 days for links between accounts).
- Leaked password check. Only the first five characters of a one-way hash of the password reach us. We cannot tell which password it was and do not record it.
- Email codes. To confirm a sign-in, we send a six-digit code to an email address through our email provider. The address is held for at most 10 minutes and the code expires after 10 minutes.
To exercise your rights over this data, contact the site you were using; we help them answer. You can also write to us and we will pass your request on.
2. Customers and visitors of revokegpt.com
This website sets no cookies, runs no analytics or advertising scripts and loads nothing from other companies. Our hosting provider processes standard request data (such as IP address) to deliver the page and protect it from attacks.
When you create an account in the dashboard, we keep your email address, your organisation and team details, the sites and keys you create, and an audit log of changes. We use this to run the service, secure your account, and send you service email. We keep it while your account is open and delete it after you close it, except where the law requires us to keep records. Our sign-up form is itself protected by RevokeGPT.
3. Who processes data for us
| Provider | What for |
|---|---|
| Cloudflare | Running checks at the edge, storage, logs, analytics, sending email |
| Supabase | Account database and sign-in, hosted in the EU |
| Paddle | Taking payment for plans, as our Merchant of Record |
Data may be processed in the countries where these providers operate. Where data leaves the EEA or UK, we rely on the providers' standard contractual clauses or equivalent safeguards.
Payments
When you buy a plan, Paddle.com is the Merchant of Record and takes the payment. Paddle receives your payment details, billing name and address, email address and tax details, and uses them as an independent controller to process the payment, prevent fraud and meet its tax and legal duties; its own privacy policy applies to that data. We never see or store your full card number. We receive from Paddle only what we need to run your subscription: your email, your plan, and the status and dates of your payments. For that data we act as controller. Paddle also acts as our processor for the subscription records it holds on our behalf.
4. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict its use, and complain to your data protection authority. Write to privacy@revokegpt.com and we will reply within one month.
5. Security
Data is encrypted in transit and at rest. Secret keys are stored only as keyed hashes. Access to production systems is limited and logged. If you find a security issue, please tell us at hello@revokegpt.com.
6. Changes
If we change this policy we will update the date at the top, and tell customers by email before a change that matters.