Hidden Catch (“we,” “us”) helps you understand contracts, leases, policies, and other documents. This policy explains what we collect, what we deliberately do not collect, and the rights you have over your information.
Documents you submit
Documents you paste, upload, or photograph are processed ephemerally to generate your risk report. We do not retain document contents after your scan completes, and we do not use your documents to train models. Only non-identifying metadata about a scan is recorded: the document category, its overall risk level, and the time of the scan.
To generate your report, the document text is sent to OpenAI, our AI analysis provider, under API terms that do not use it to train models. We additionally set the no-storage flag on every request, so the content is not kept in reviewable provider logs. Under OpenAI's API policy, a copy may be held by OpenAI for up to 30 days solely for abuse and misuse monitoring and is then deleted. No other third party receives your document content.
The same rules apply to the follow-up tools. If you ask questions about a report, the document text held in your browser tab is sent to OpenAI to answer them, under the same no-training terms and retention limits described above. Comparing two reports or drafting a negotiation reply sends only the reports' findings, never the document text. In every case, the results exist only in your browser tab unless you export or save them yourself.
If you turn on the optional “keep reports on this device” setting, past reports are saved in your own browser's storage, on your device. They never reach our servers, and deleting them or turning the setting off removes them from your device.
Government and identity documents
Some documents you scan, such as immigration or other government forms, may contain identifiers like passport numbers or case numbers. These pass through the same ephemeral pipeline as every other document and are never stored by us. If you prefer, you can redact identification numbers before scanning; doing so does not reduce the quality of the analysis.
When you run the optional official source check, we search public government websites using queries built from the document's general claims, such as a form number or a fee amount. Those queries never include your name, identification numbers, or other personal details.
Account information and service providers
If you create an account, we store your email address, your scan-credit balance, and the scan metadata described above so we can provide the service. Authentication and our database are hosted on Supabase. Purchases are processed by Dodo Payments, our merchant of record, which handles your payment details; we never see or store full card numbers. We do not sell your personal information, and we do not use it for advertising.
Cookies
We use only the cookies required to keep you signed in. There are no advertising or cross-site tracking cookies on Hidden Catch.
Security and abuse prevention
To protect the service from automated abuse, we apply short-lived rate limits keyed to your IP address. These counters are processed by Upstash, our rate-limiting provider, expire within minutes, and are never linked to your documents or your account activity.
Your rights
You can ask us at any time to tell you what personal information we hold about you (it is short: your email, credit balance, and scan metadata), to correct it, or to delete your account and everything tied to it. Email us at the address below and we will act on the request promptly. We will never treat you differently for exercising these rights. If you are in a jurisdiction with specific privacy laws, such as the EU/EEA, the UK, or California, these rights apply to you under those laws; where local law grants you more, local law prevails.
Where data is processed
Our servers and database are hosted in the United States, so the limited account data described above is processed there. The protections described in this policy apply to your information regardless of where you live.
Contact
Questions about this policy, or a privacy request? Email support@hiddencatch.com. We usually reply within one to two business days.