Privacy Policy

Last updated October 15, 2026

Reasonably (the “Service”) is operated by WalkerTek (“we”, “us”). This policy explains what information the Service handles, why, who else sees it, and the choices you have. Please read it together with the Disclaimer.

1. Information we handle

Account information

• Your email address and a salted hash of your password (we never store the password itself).
• Your plan and billing status (payments are handled by Stripe; we never see or store your card number).
• If you turn on two-factor authentication: an encrypted authenticator secret and hashes of your recovery codes.
• API tokens you create (stored only as hashes).

Content you submit and what we generate from it

• Web addresses you analyze, files you upload, and pages or selected text you send from the browser extension or bookmarklet. We keep the original content and the text we extract from it.
• Everything generated from it: summaries, conclusions, premises, scores, tags, fact-check results, comparisons, earlier versions, reputation figures for authors and websites, and your library, searches and exports.
• Your content may contain personal information about you or other people. Please only submit content you are entitled to share (see the Disclaimer).

Usage and security data

• Credit usage, background job records, and the documents you share, remove or fact-check.
• Sign-in activity: time, IP address, browser/device description and whether a sign-in succeeded, kept so you can review your account and so we can send security alerts.
• Short-lived counters keyed by IP address, email or account that limit abuse (rate limiting).
• Our servers and hosting provider also keep routine technical logs (such as IP address, time and requested page).

2. How we use it

To run the Service: analyze what you submit, keep your library, search and export it, fact-check claims, share documents when you ask us to, bill you, secure your account (2FA, alerts, rate limits), send the emails you trigger or need (verification, password reset, share invitations, security alerts), prevent abuse, fix problems and comply with the law. We do not run advertising or analytics trackers, and we do not sell your personal information.

3. Who else receives your information

• AI providers. To analyze a document, the text we extract from it (and, for long documents, the parts of it) is sent to the AI service(s) this Service is currently configured to use: an OpenAI-compatible model server chosen by the operator, Anthropic, xAI, Google. Their own terms and privacy policies govern what they do with it.
• Web search. When you run a fact-check, the factual claims taken from the document are sent as search queries to Tavily, and the returned snippets are sent to the AI provider to judge the claim.
• Stripe processes subscriptions and payments and receives your email address and billing details.
• Google reCAPTCHA protects the sign-up form from bots. When you open it, Google receives your IP address and browser information, and Google's Privacy Policy and Terms apply.
• Email delivery. Emails are sent through Amazon SES (Amazon Web Services), which receives your email address and the message.
• Hosting and infrastructure providers that store and run the Service and its backups.
• Other people you choose. If you share a document by email, the recipient gets their own copy of the analysis including the extracted text. Documents are otherwise private to your account. (If you and someone else analyze exactly the same content with the same model, the stored analysis is reused internally; neither of you can see the other's library.)
• Administrators. Administrators of the Service can view accounts and documents for support, security and abuse prevention. Administrator actions, including opening someone else's document, are recorded in an audit log.
• Legal. We may disclose information when required by law or to protect rights, safety and the Service.

These providers may process data in countries other than yours.

4. Cookies and similar technologies

• Session cookie (essential): keeps you signed in and protects forms against forgery. It is also used to remember an anonymous visitor's library before they sign up.
• Device cookie aa_did (security): a random identifier, stored as a hash on our side, that lets us recognise a browser you have signed in from (for “new device” alerts and the optional “trust this device” for two-factor authentication). It lasts up to a year; you can remove devices on your Security page.
• The optional browser extension stores your server address and API token in the browser's local extension storage and sends the token only to this Service.
• We do not use advertising or cross-site tracking cookies.

5. How long we keep it

• Documents and analyses: until you remove them. When the last person who holds a document removes it, the document and everything derived from it (text, tags, earlier runs, fact-check, search entries) is erased.
• Background job records: about 7 days after they finish (uploaded bytes are dropped as soon as the job ends).
• Sign-in activity: 90 days.
• Pages sent by the bookmarklet and not confirmed: about 15 minutes.
• Rate-limit counters: hours, then discarded.
• Account data: while your account exists. Deleted data can remain in routine backups until they rotate out.

6. Your choices and rights

• View, search and export your library (Obsidian vault or plain markdown) at any time, and remove any document.
• Manage two-factor authentication, trusted devices, security alerts and API tokens on your account pages.
• To delete your account, or to ask about, correct or receive a copy of your personal information, contact us through WalkerTek (WalkerTek.com). Depending on where you live you may have additional rights (for example to object to or restrict processing, or to complain to a data protection authority).

7. Security

Passwords are hashed, authenticator secrets are encrypted, traffic is protected with HTTPS, and the Service uses rate limiting, sign-in alerts and optional two-factor authentication. No system is perfectly secure, so please use a strong, unique password and turn on two-factor authentication.

8. Children

The Service is not intended for people under 16, and we do not knowingly collect their information.

9. Changes and contact

We may update this policy; the date above shows the latest version, and continued use means you accept the update. Questions: WalkerTek, WalkerTek.com.