Privacy Policy

Who we are and what this covers

Critical Analysis IO Inc. (Ontario, Canada) operates the website at criticalanalysis.io, which is available to a global audience. In this policy, “we” and “us” mean Critical Analysis IO Inc..

This policy covers the website, your Critical Analysis account, and the analysis service that our apps (such as me.app and our workspace portals) and the Chrome extension use. The extension’s browser permissions and its own data disclosures are in its Chrome Web Store listing.

For privacy questions or requests, email support@criticalanalysis.io.

Who accounts are for

Accounts are for people who are 18 or older. The public pages of this website are informational and do not ask for your age.

Information the website handles

• Technical request information. The systems that deliver the website receive your IP address, browser and device details, the page you asked for, the page that referred you, and the time of the request. We use it to deliver and operate the website, and we use your IP address to limit how often a client can call our service.
• Account sign-up. The sign-up form sends the email address, password and optional invite code you enter to our account service so it can create your account. Email confirmation and password-reset links carry a one-time token in the address; the page uses it only to complete that step and removes it from the address bar. The sign-in page does not collect your credentials; it sends you to the app or to your workspace address.
• Beta waitlist and support email. The waitlist form prepares an email in your own email application and does not send its fields to a website database. We receive the information in a message only if you send it, together with the usual email details. Email providers involved in delivering the message may also process it under their own terms. We use what you send to reply to you and, for the waitlist, to email you about beta access and product availability. We will not use waitlist details for broader marketing without your separate consent.
• Public feed and shared analyses. The Feed and shared-analysis pages show analyses that have been made public or shared by link. Anyone with the link, and anyone who visits the Feed, can see them. These pages load the analysis from our service when you open them.
• Purchases. The website shows what is available. Purchases, including subscriptions where they are available, are completed on Stripe’s checkout pages and subscriptions are managed in Stripe’s billing portal. This website does not receive your payment card details. After checkout, the return page uses the order reference in the link only to send you on to the app.

Your account and analyses

When you create an account, our account service holds your email address and your password, and we keep records of your account, your use of the free allowance, and your purchases and subscription status. This website does not store your password.

When you run an analysis in our apps, the text, link content or image you submit is sent to a third-party AI model provider that processes it to produce the analysis. This policy does not describe that provider’s own handling of the content. When you submit a link, the address of the link, including its path and any query, and any other address we work out for that page, such as its canonical address, is also sent to a separate third-party link-reading service, Jina Reader, which retrieves the page and returns its text to us. The page text, with the address of the link, is then sent to the AI model provider. This policy does not describe Jina Reader’s own handling of information. The analysis is saved to your account together with the text, link or screenshot you submitted and the result. A submitted screenshot is stored as an image file with its own web address.

Content we fetch for you. We are changing the service so that, when an analysis is based on a web page retrieved from a link (by the link-reading service or, if that does not work, by us), or on text that the Chrome extension sends marked as taken from a web page or social post, that copy of the page text is deleted from the saved analysis once the analysis has finished, failed or been cancelled. We would keep the result, the address of the link, the short excerpts the analysis quotes as evidence, and a hash of the page text. Until that change reaches the service you are using, the page text may still be stored with the analysis. Text sent without that mark is treated like text you paste, and text you paste yourself and screenshots or images you upload are kept with the analysis as described above. This does not reach backups, logs or the AI model provider’s own handling, and this policy does not state when the change takes effect or when the deletion happens.

Private by default. An analysis is private unless it is shared, and our systems treat an analysis with no sharing setting as private. In this policy, private means that the analysis is not shown on a share page or in the public Feed. An analysis can be shared by link or made public. Anyone with the link can see a shared analysis, and a public analysis also appears in the public Feed. For a shared or public analysis, visitors can see the analysis and the text, link or screenshot that was analyzed, including the name or handle of the original poster where one was recorded. People who operate the service with administrative or support access can view stored analyses, including private ones.

Link previews. When the link to a shared or public analysis is posted somewhere that builds previews, such as a social network or messaging app, that service asks us for a short summary of the analysis: its topic or title and a short extract of its summary. Anyone who sees the preview sees that summary without opening the link.

Workspaces. An analysis run in a workspace belongs to that workspace and is visible to its members according to the workspace’s roles and settings. A workspace analysis cannot be made public in the Feed, but its owner can turn on a link, and then anyone with the link can see it.

Screenshots and sharing settings. Making an analysis private again takes it off its share page and out of the Feed. It does not delete the stored screenshot file or change that file’s web address. This policy does not promise that a stored screenshot can be opened only by you, or that it is removed when you change a sharing setting.

People, accounts and organizations named in content. Analyses also create and update records about the accounts, people and organizations named in the content, such as a name or handle, the platform and how often it has been analyzed. These records are not tied to a single user account. They are not changed when an analysis is made private, and deleting an account does not by itself remove them. Other signed-in users may be able to look up that such a record exists, with its name, platform and type.

Emails we send

Service emails. We send the emails needed to run your account, such as email confirmation and password reset, and other messages about your account or purchases. These are separate from marketing and are not controlled by a marketing choice.

Marketing emails. We send marketing emails only to people who have separately opted in. That opt-in is optional, is never pre-checked, and every marketing email will include a way to unsubscribe.

Analytics and cookies

Analytics on this website is optional. We use Google Analytics to measure website traffic and sign-up conversion, and only if you choose Accept in the privacy notice. Until you choose Accept, the website does not load Google Analytics and does not set Google Analytics cookies. We do not currently use Google Analytics for advertising or remarketing.

If you accept, Google Analytics receives:

• the address of each page you view, without any query string or fragment, and the website you came from (for other websites, the domain only);
• which Extension, Beta or contact links you click and the text of those links, and when the waitlist form or a sign-in form is submitted;
• on shared-analysis pages and sign-up: whether a shared analysis page loaded (or why not), whether the sign-up link was clicked, and whether sign-up succeeded and whether it came from a shared analysis page. We do not send the analysis, its ID, your email address or your password.

Google also receives the information any browser sends when it contacts Google, such as your IP address and browser details, and may derive information such as device, browser and approximate location from them. See Google's privacy policy.

We configure Google Analytics on this website with advertising storage, advertising user data and ad personalization denied, and with Google signals and ad personalization signals turned off in our tag settings.

What the website stores in your browser:

• Google Analytics cookies (such as _ga and a _ga_ cookie named after our measurement ID), only after you accept. They let Google Analytics tell visits apart.
• ca_analytics_consent_v1 (local storage). Remembers whether you accepted or rejected, so we do not ask on every page. It stays until you clear your browser data or change your choice.
• ca_entry (session storage), only after you accept. Remembers, in one browser tab, that you went to sign-up from a shared analysis page so a successful sign-up can be counted. It is removed when used or when the tab closes.

The website’s own code does not set any other cookies.

Changing your choice. Use Privacy Choices in the footer of any page. Choosing Reject, or opening Privacy Choices, stops further Google Analytics data collection from your browser and removes the Google Analytics cookies the website is able to remove. It does not delete information already sent to Google, which stays under Google’s settings and terms.

The website does not currently respond to Do Not Track or Global Privacy Control signals. Because analytics is off unless you accept it, rejecting or not choosing has the same effect on Google Analytics.

Sign-in and storage in our apps

Our apps keep a sign-in token and your display preferences in your browser’s local storage so that you stay signed in. Some also keep a record of an analysis in progress, so that retrying it is not charged twice, and your allowance and purchase status. The apps do not load Google Analytics or set advertising cookies. The Chrome extension keeps your sign-in, workspace and usage information in its own storage on your device.

Other services the website uses

• Google Fonts. Pages load typefaces from Google (fonts.googleapis.com and fonts.gstatic.com). Google receives your IP address and browser details when a page loads, whether or not you accept analytics.
• Hosting. The website and our application services are hosted on Railway, which processes request information in order to deliver them.
• Database, sign-in and file storage. Your account, your analyses and stored screenshot files are held with Supabase.
• Link reading. When you submit a link to be analyzed, Jina Reader receives the address of the link, retrieves the page and returns its text to our service. This policy does not describe Jina Reader’s own handling of information.
• Stripe, when you purchase, on Stripe’s own pages.
• Links and share buttons. The website links to the Chrome Web Store and to our apps, and some pages offer sharing to X and LinkedIn. Those services are contacted only when you follow a link or press a share button, and they have their own privacy policies.

Providers such as Google may process information in countries other than your own. This policy does not describe where our providers’ systems are located or any arrangements for transfers between countries.

Content you submit for analysis

Content you submit to our apps for analysis is outside this website policy. This policy does not give us a right to use your content to train AI models. If we ever wanted to use content that way, we would first give appropriate disclosure and obtain any authorization that is required.

How long information is kept

This policy does not state fixed retention periods. Analytics data held by Google and request logs held by hosting providers are governed by those providers’ settings and terms. We have not published a retention period for email correspondence.

Deleting your account

The apps do not currently let you delete your account yourself. To ask us to delete your account, email support@criticalanalysis.io. Analysis records may be kept separately where the law allows. We will not make a previously private analysis public because an account is deleted. Deleting an account does not by itself delete saved analyses, stored screenshots, or records about people, accounts and organizations named in submitted content.

Your choices and requests

You can change your analytics choice at any time with Privacy Choices in the footer. To be removed from the beta waitlist, email support@criticalanalysis.io.

Depending on where you live, you may have legal rights over your personal information, such as asking to access, correct or delete it. To make a request, email support@criticalanalysis.io. We may need to confirm who you are before acting on a request.

If you are not satisfied with our response, please contact us first. You may also be able to complain to a privacy regulator where you live.

Changes and contact

We may update this policy. The date at the top of this page shows when it last changed.

Critical Analysis IO Inc. · support@criticalanalysis.io