Legal
Privacy Policy
TrueStandard Labs LLC operates TrueStandard. This page says what we collect, which companies see it, and what we will never do with it. Questions go to hello@truestandard.ai.
Last updated August 28, 2026
The short version
We do not train on your drafts. Not on any plan, not in aggregate, not later. Your content exists on our servers to run the check you asked for, and to sit in your history until you delete it.
What this policy covers
TrueStandard Labs LLC runs several services, and this policy covers all of them: the TrueStandard web app at truestandard.ai, the free checks, and the TrueStandard CLI and API. Where a service handles data differently, this page says so by name.
It does not cover products operated by any other company, including companies with the same people behind them. If we launch another service under this entity, it gets named here.
What we collect
What you give us
- Your account. An email address, and a password if you sign up with one. Sign in with Google instead and Google sends us the email address, name, and profile image on that account.
- What you submit to a check. The drafts, claims, questions, and instructions you send us, plus the results we return and any follow-up turns in the same session.
- Files you upload. Text, Markdown, CSV, PDF, and Word files up to 5 MB. We read the text out of the file in memory and store only that text. The file itself is never written to disk.
- Billing details. Stripe collects your card on its own checkout page. We never see or store a card number. What we keep is a Stripe customer ID, a subscription ID, your plan, and how many credits you have used.
- Anything you type into a form. Waitlist and email-capture fields, and whatever you write to us.
What we record automatically
- Your IP address, against free tool runs and email captures, so the daily limits cannot be bypassed by clearing cookies.
- How you arrived, once: a utm_source or ref parameter in the URL and the site that linked you. We store the host and path, not the full referring URL.
- Run telemetry: timestamps, which models ran, token counts, what the run cost us, and any error message.
- Server logs, in the ordinary way a web server keeps them.
That is the whole list. We do not collect your location, your contacts, your browsing outside truestandard.ai, or anything from a device sensor.
What we do with it
Run your checks and show you the results. Keep you signed in. Bill you, meter your credits, and tell you when they run out. Send the few transactional emails the service needs, like a password reset.
Enforce the free daily limits, investigate abuse, and keep the service up. Answer you when you write in.
Understand aggregate usage, meaning counts and costs across all accounts. That work never involves reading your drafts.
What we do not do
We do not train models on your content, and we do not build a dataset from it.
We do not sell your data or share it for advertising. There is no advertising business here to feed.
We run no analytics or tracking product at all. No Google Analytics, no PostHog, no Mixpanel, no advertising pixels, no session recording.
We do not read your drafts except to fix a failure you have reported to us, or where the law leaves us no choice.
Where your content goes to be checked
A check works by sending your text to several AI models at once. We reach those models through OpenRouter, which routes each request to the company that runs that model. Today that means OpenAI, Anthropic, Google, xAI, and Z.ai.
So your text leaves our servers for as long as the check takes, and while it is with those companies their terms govern it. We do not train on it and we do not authorize them to train on it as part of our service. We also do not run their infrastructure, which is why we name them here instead of writing "our AI partner" and leaving you to guess.
Turn web search on for a check and the model can issue searches derived from your text, through OpenRouter's search plugin.
When a check verifies citations, we send only the DOI or the citation string to Crossref, the registry that issues DOIs. Your draft does not go to Crossref.
Every company that touches your data
The full list, with what each one actually sees.
| Company | What it does for us | What it sees |
|---|---|---|
| OpenRouter | Routes each check to the models that run it | The text you submit and the check instructions |
| OpenAI · Anthropic · Google · xAI · Z.ai | Run the models behind every check | The text you submit, passed through by OpenRouter |
| Stripe | Checkout, subscriptions, and the billing portal | Your name, email, and card details, entered on Stripe's own page |
| Sign in with Google, if you use it | Your Google email address, name, and profile image | |
| Google Fonts | Serves the typefaces every page is set in | Your IP address and browser, on every page you load |
| Crossref | Resolves the DOIs a citation check finds | The DOI or citation string only |
| Cloudflare | DNS, TLS, and bot protection for truestandard.ai | Request metadata, including your IP address |
| DigitalOcean | Hosts the application and the database | Everything we store, at rest on our servers |
Nobody else. We use no third-party analytics, no advertising network, no data broker, and no object-storage provider.
Google Fonts is the one entry on that list you do not choose. Loading a page fetches the typefaces from Google, which means Google sees your IP address whether or not you ever sign in. It sets no cookie and receives nothing you write. We are moving these files onto our own servers to end that transfer, and this row goes when they land.
How long we keep things
Your account and your checks stay until you delete them. Your history is part of what you are paying for, so a check from six months ago still opens.
Delete your account and we delete the account record, your checks and the text in them, your sessions, and the subscription row. Any copy sitting in an operational backup goes when that backup is replaced.
Billing records outlive the account where tax and accounting law requires it. Rate-limit rows keyed to an IP address are kept while the limit window needs them.
Your rights
Wherever you live, you can ask us to do all of this, and we answer within 30 days. Write to hello@truestandard.ai from the address on your account.
If you are in the EU or UK
- Get a copy of everything we hold on you.
- Have anything inaccurate corrected, or have the whole record erased.
- Take your data elsewhere in a portable format.
- Object to a particular use of it, or ask us to restrict that use.
- Complain to your national data protection authority.
If you are in California
- Know what we collect, why we collect it, and which companies receive it.
- Have it deleted, or corrected where it is wrong.
- Opt out of sale or sharing, though there is nothing here to opt out of, because we do neither.
- Get the same service either way. Asking will not cost you your account or your plan.
Under the GDPR our legal bases are performance of the contract for running your checks and billing you, legitimate interests for security and abuse prevention, and consent where you gave it, such as a waitlist signup.
Deleting your account
There is no delete-account button in the app yet. Email hello@truestandard.ai from your account address, ask for deletion, and we do it within 30 days and write back to confirm.
When that button ships this paragraph will say so.
Security
Every request runs over TLS. Passwords are stored as bcrypt hashes and never in readable form. API keys live in server environment variables, never in the codebase. Production database access is limited to the operator.
No system is airtight. If we find out your data was exposed, we tell you and the relevant regulator without sitting on it.
Where your data lives
Our servers are in the United States. Using TrueStandard from outside the US means your data is transferred there and to the companies listed above, some of which process data in other countries. Where a transfer out of the EU or UK needs a legal mechanism, we rely on the European Commission's Standard Contractual Clauses through our agreements with those companies.
Age
TrueStandard is for adults. You must be at least 18 to use it, and we do not knowingly collect anything from a child. Tell us at hello@truestandard.ai if you believe a child has an account and we will remove it.
Changes to this policy
We update the date at the top whenever this page changes. If a change materially affects your rights, we email account holders before it takes effect.
Contact
TrueStandard Labs LLC, a Texas limited liability company, reachable at hello@truestandard.ai. Write for anything on this page, including a request to see, correct, or delete your data.