The short version: the checker does not upload your code or findings. It has no account system or AI review. Optional Google Analytics loads only after permission. Your analytics choice is saved in your browser for up to 180 days.
1. Pasted code and analysis results
When you use the checker, your snippet is held in the editor and passed to a Web Worker in your browser. JavaScript and TypeScript are parsed with Babel and checked by custom rules. Python is checked with the official Ruff WebAssembly engine. Your submitted program is not executed.
The checker does not send source code, expected behavior, findings or generated reports to our servers, an AI model or analytics services. This release has no LLM integration, repository connection, server-side scan or user account.
Code and results remain in this page’s memory rather than localStorage, sessionStorage, a cookie or a hosted report database. Clear removes the current checker’s code and report. Reloading or leaving the page discards unsaved work. Editing code invalidates its old report. The browser and extensions you choose are outside the checker’s own storage behavior.
If you download JSON or Markdown, a file is generated locally and saved according to your browser’s download settings. That file may contain findings and code-derived identifiers. You control its storage, backup, deletion and any later sharing.
2. Analyzer downloads and hosting
The site downloads JavaScript and other static files needed to work. The first Python check also downloads a roughly 10 MB Ruff WebAssembly file. A download request identifies the requested asset; it does not contain your snippet. Your browser may cache these public analyzer assets to speed up later visits.
The website and public assets are delivered through Cloudflare infrastructure. Assets may be served from a separate Cloudflare R2-backed delivery hostname. Standard delivery and security processing can involve IP addresses, request times, requested paths, browser or connection information and security signals.
These infrastructure requests are distinct from code processing. We do not put code in URLs or send it as part of an asset request. Infrastructure log availability and retention depend on the active hosting settings and Cloudflare’s policies; the local-only checker is not a claim that visiting a website produces no network metadata.
3. Optional Google Analytics
Analytics is off until you choose to allow it. Before permission, the site does not load the Google Analytics script. If analytics is not configured for this deployment, allowing it records your choice but does not create a Google Analytics connection.
When configured and allowed, the site sends page-view information to Google Analytics, such as the page path and title, to understand which resources are being read. The site’s analytics code excludes URL query strings and fragments, sends no page referrer, and does not intentionally send code, findings, editor contents, contact messages or downloaded reports.
Google may process the standard technical information associated with an analytics request and set analytics cookies when permitted. Google signals and advertising personalization are disabled in this implementation. The site does not use session replay or record the editor. Analytics data and cookie retention follow the configured Analytics property and applicable Google policies; the 180-day preference period described below is not an analytics-data deletion deadline.
You can open at any time, including from the footer, and withdraw permission. The site stops further analytics use, removes its Analytics script and attempts to clear the relevant first-party analytics cookies. If Google Analytics has already loaded, withdrawal refreshes the page to remove the running third-party code. That refresh clears unsaved checker code and results. Copy your snippet or download a report first if you want to keep it.
Withdrawal changes future collection; it does not itself erase data already received by Google. For questions about any available deletion options, email [email protected].
4. Browser preference storage
The key aicodeverify:analytics-consent in localStorage stores your allow/deny choice, the consent version and a timestamp. It expires after 180 days; an absent, invalid or expired record is treated as no permission. It contains no source code or findings.
The temporary sessionStorage key aicodeverify:analytics-revoked records a rejection, consent version and timestamp so a failed preference save cannot restore an earlier permission in that tab. A separate temporary notice can indicate that a consent change refreshed the page. Consent changes may be synchronized between open tabs so one tab does not keep analytics running after you withdraw in another. These mechanisms contain no submitted code. If your browser blocks storage, a choice may not remain saved across visits; analytics stays off when permission cannot be reliably read.
5. Contact email
Contact links open your email application. Sending an email is separate from using the local checker. A message can include your email address, headers and any text or attachments you choose to send. Those details are used to read and respond to the request or investigate a reported problem.
Email delivery and reply services are selected during operations setup. Depending on the active configuration, they may include Cloudflare Email Routing, Gmail and Resend. This notice does not claim that every candidate service is enabled or that a specific delivery route has been independently verified. We will describe a materially different arrangement before using it.
Do not email credentials, sensitive personal information or proprietary code. A minimal synthetic example is preferable for a checker issue. Email is not covered by the checker’s in-memory lifecycle, and this notice does not promise automatic deletion of email after a fixed period. Ask about a particular message using the contact address.
6. Your choices
- Use the checker without an account or analytics permission.
- Clear the editor and report whenever you want to discard the current work.
- Download a report only when you want a local copy, and delete that copy through your device.
- Change analytics permission through the footer. Browser privacy tools can apply additional controls.
- Choose what to include in an email, and request correction or deletion of a particular message.
7. Changes and questions
If the product later adds server-side code processing, accounts, paid features or an AI service, its processing details and controls must be described before that feature is enabled. This notice covers the local checker currently provided.
AI Code Verify is the independent project publishing this site. For privacy questions, contact [email protected]. See About for the project and editorial standards.