Privacy Policy

The short version

GAIC is designed to minimize collection. Text checks and the bundled image model run on your device, and the on-device result appears first. Image, video-frame, and screen-frame content stays on-device by default. On the web, an image up to 3 MiB is uploaded only when an active, server-verified GAIC Pro subscriber enables the separate cloud option for that check. Native media checks stay on-device in this release.

What we process

• Text checks and writing assist — analyzed and edited locally on your device. The writing workspace uses deterministic wording rules, stores no draft library, and does not send your original or suggested text to our servers.
• Image checks — the three bundled GAIC Image Forensics v3 pixel classifiers, camera metadata, and supported embedded Content Credentials are read locally. Photos and sampled video frames use a locked high-confidence rule: the primary and verifier must pass the base gate, then either one must reach its stronger cutoff or the web-robustness arbiter must independently confirm the ambiguous case. Screen checks use seven full-precision views and require the same strong primary-or-verifier evidence on a matching crop, or extreme broad agreement across the fixed views. The official Content Authenticity Initiative SDK checks the credential's manifest, signature, asset binding, validation state, and signer trust against a bundled checksum-pinned official trust-list snapshot. Remote-manifest fetching is disabled, and GAIC displays only controlled status categories rather than arbitrary manifest text. If the validator, local runtime, or trust list cannot complete a check, the result is unavailable rather than invalid. Optional cloud analysis (Advanced Scan) is not available today. When it is offered, it is available only to a server-verified GAIC Pro web subscription after you tick its separate consent box for an image no larger than 3 MiB. Your local result is displayed before this work starts. Our API stores the temporary image payload only as AES-GCM-encrypted ciphertext accessible to the background job for up to 15 minutes. QStash receives an opaque job ID and limited orchestration metadata, not the image or the decryption key. The worker decrypts the payload only to send the image to our configured inference provider, which processes it to return the second model signal and may handle request data under its applicable service and retention terms. GAIC deletes the encrypted image payload promptly when the job completes or fails; bounded cleanup removes expired payload and owner-scoped, image-free status records. Deleting the owning account purges its remaining GAIC-controlled status, encrypted-payload, and lease records immediately.
• Video and screen checks — supported embedded video Content Credentials are checked locally before GAIC requests up to eight still frames spread across the video's full timeline. Only confirmed seeks are scored; audio and motion over time are not analyzed. On the website, screen capture watches a screen or window you explicitly choose for about four seconds, samples up to eight still frames, and stops sharing before showing a preview. Choose Check to analyze those frames or Discard to remove them without a check. No audio or recording file is captured, and these frames are never uploaded. Frames remain temporarily in this page until a check completes, you discard or replace the capture, or the page closes. If a check cannot complete, the preview remains available to retry or discard.
• Browser extension — the GAIC Chrome extension inspects and captures the visible tab only after you open its popup and choose Scan this page. It reads the current tab’s bounded hostname/title and visible image, video, canvas and CSS-background geometry, captures one screenshot and an optional media crop, and analyzes them with bundled models on your device. Screenshots, crops, page context and results stay in temporary popup memory and are discarded on close. They are never sent to the account service. There is no continuous recording, background scanning, browsing-history access or analytics. Early users retain their existing free local scanning, including updates, without an account or subscription. A small local scanning-policy record preserves this access across updates. After reinstalling or clearing extension data, a user whose saved early-access record is missing can choose Early-user access help to contact support. The old extension kept no account or install history, so prior use cannot be automatically verified after data loss. Opening help or claiming prior use does not unlock scans or a paid web/app entitlement. Missing or corrupt history uses the bounded anonymous trial; it does not establish early-user access. New users receive five successful free scans total in this Chrome profile, with no daily or weekly reset, then need a verified GAIC subscription or earned account bonus scans; failed and cancelled scans do not count. Clearing extension data or reinstalling can reset that anonymous allowance or erase the early-access record; we do not fingerprint or track installations. Sign-in and payment take place on the GAIC website. Choosing Sign in or Subscribe requests optional access to our API for account connection, subscription and earned referral-credit verification, and revocation. The extension receives an extension-only capability, not your website access or refresh token. The capability and account ID are kept in trusted-context session storage, expire within one hour or sooner when the originating Auth token expires, and are lost on browser restart. We verify paid access before capture and before completing a paid scan. Signing in or returning from payment never starts a capture. Website account changes and sign-out invalidate the paid account connection without removing early-user free local scanning; a linked sign-out that cannot finish is shown for retry. The website keeps a per-account connection marker until its site data is cleared. Our server keeps one bounded account ledger with hashed code/capability nonces, hashed Auth-session identifiers and expiry times, not raw tokens, screenshots or results. Codes last at most60 seconds; revocation entries cover the accepted outstanding-token lifetime. Expired entries are pruned on subsequent activity. Account deletion erases the ledger contents and indefinitely retains only a one-way account reference and deletion flag as a pseudonymous security marker to prevent an in-flight request from recreating the connection. This security marker contains no raw account ID, session identifiers or tokens. Existing security rate limits and provider operational records described below also apply to account requests. An interrupted bonus confirmation retains only its account ID and random request ID locally so an explicit retry cannot debit it twice; it contains no token or scan content. Share GAIC opens the website to prepare an account-bound invite link. Feedback is a local note you can copy and choose to send by email. The extension’s use of website data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only for the scan or account access you request, never for advertising, sale, credit decisions, or unrelated purposes. NIRO and third parties do not receive the scan data or read its contents.
• Native shortcuts and sharing — iOS App Intents can open the scanner or accept one image or text value that you explicitly pass from Siri or Shortcuts. A content action opens GAIC and runs that one local check. Image input is capped at 8 MB, signature-checked, copied once into protected app cache, and deleted after handoff. A single-image HEIC/HEIF input is converted locally to a bounded JPEG derivative for the visual model; GAIC does not treat the derivative's missing Content Credentials or metadata as evidence about the original. Text is capped at 100,000 UTF-16 units and 256 KB and removed from the handoff cache immediately after reading. If you deliberately choose GAIC from Android's share sheet, the app accepts either plain text or one supported image and stages it for review without automatically checking it. Android shared images receive the same bounded signature check, one-shot private-cache copy, and deletion. Neither platform uses an accessibility service, overlay, or background screen observer.
• Usage counts in the website and native apps — the counter tracks successful checks and remaining referral scans, never the checked content or result. The server stores an account balance and a random identifier for each decision so retries cannot spend twice. Guest usage is stored locally and can be lost when app data is cleared. Signed-in balances follow your account across devices. Five free checks are available in total; earned referral scans do not expire. Failed and canceled checks do not count. When you first link guest usage to an account, we retain a random transfer ID, a one-way account reference and the successful-check count to prevent a repeated import. This record contains no scan content and survives account deletion to prevent reuse. The local allowance then requires that account to continue; signing out does not refill it.
• Optional account referrals — when you request an invite link, GAIC creates a referral code associated with a one-way account reference. Following that link records a visit time, a code, and a hashed attribution token on the server. This browser stores the pending token, code, expiry, and the first account that attempts to claim it so signup and email verification can be matched to the visit. Complete signup and email verification within 30 days; expired landing records are removed by bounded cleanup. The server checks account creation and email verification times with GAIC's authentication provider without adding those timestamps to the referral ledger. A qualifying new account credits the sharer with five bonus scans exactly once. Earned bonus scans do not expire. The ledger keeps one-way account references, campaign, award time, balance, and duplicate-prevention records. It contains no email address, contacts, submitted content, scan results, social identity, or analytics identifier. Sharing and copying a link do not prove delivery or earn a reward. This program is optional and does not restrict paid access.
• Account — checking content does not require an account. A free GAIC account is required to buy or restore a subscription in the iOS or Android app so the store transaction can be validated for the correct account and restored on another client. If you create one we process your email address, and a password that is hashed and stored by our authentication provider — we never see or store your password ourselves. Choosing "Continue with Google" shares your email address with us from that provider. Accounts live in GAIC's own dedicated Supabase project, separate from our other apps, so a GAIC account is not linked to any other NIRO product. We use it only to sign you in, tie your allowance and any subscription to you, verify optional referral eligibility, and contact you about your account. You can delete the account and its data at any time from Delete account in the account panel.
• Product analytics — The web, iOS, and Android checker can send privacy-minimal first-party product analytics to NIRO's service, but analytics stays off until you choose Allow in Privacy choices. Global Privacy Control or Do Not Track always overrides the local choice. Each product event contains only a one-time random event ID, a fixed event name and fixed broad mode or outcome, web/iOS/Android surface, major.minor app release, coarse operating-system family and major version, and broad device class. The service adds a country code derived from the hosting platform's connection header so the owner report can show country-level activity. This is approximate location; no precise location is collected, and the raw network address is not stored in the analytics event. A secret-keyed pseudonymous digest of the source address is used only for abuse limits; it stops being used after ten minutes, and bounded daily cleanup removes expired digest rows. The one-time event ID is retained for duplicate prevention for 24 hours and then removed by the same bounded cleanup. Daily aggregate event, country, operating-system, and broad-device counters are retained for 13 months. Up to three fixed JavaScript-or-promise error counts can be sent per use using those same coarse fields; no error name, message, stack, or raw error object is sent. The collector never receives submitted text or media, filenames, metadata, screen frames, model scores, results, receipts, account details, email, a page address or referrer, precise location, or a stable person, account, device, installation, or session identifier. These event records are not linked to a GAIC account and are used only to understand product use, reliability, protect the service from abuse, and identify which features need attention. The separate Mac desktop build keeps general analytics off. The clearly labelled web-only Also try rail also counts fixed aggregate referrals among GAIC, DeNiro Card, PicPlots, and SkyWrite; it never runs inside the iOS or Android apps.

Subscriptions & payments

• In the iOS app, GAIC Pro is billed by Apple through your Apple ID for unlimited on-device checks. A free GAIC account is required to buy or restore. Its account UUID is supplied to StoreKit as the purchase's account token; our validation service stores a one-way account reference and current lifecycle state so the entitlement is tied to the correct GAIC account. New subscriptions start at confirmation, without a free trial, and renew at the localized App Store price and interval shown until canceled. Existing subscriptions and trials retain their agreed terms. Apple collects and manages the payment account or card information required to start. We do not receive your full payment-card details. Manage or cancel in App Store account settings.
• In the macOS app, GAIC Pro is billed by Apple through your Apple ID. New subscriptions start at confirmation, without a free trial, and renew at the localized App Store price and interval shown until canceled. Existing subscriptions and trials retain their agreed terms. Apple collects and manages the payment account or card information required to start. The Mac App Store build does not offer or link to Stripe checkout. We do not receive your full payment-card details. Store transaction data is sent to our validation service to confirm the product and entitlement. Purchase, restore, manage, or cancel through the app and App Store account settings.
• In the Android app, GAIC Pro is billed by Google through your Google Play account for unlimited on-device checks. A free GAIC account is required to buy or restore. Its account UUID is supplied to Google Play as the obfuscated external account identifier; our validation service stores a one-way account reference and current lifecycle state so the entitlement is tied to the correct GAIC account. New subscriptions start at confirmation, without a free trial, and renew at the localized Google Play price and interval shown until canceled. Existing subscriptions and trials retain their agreed terms. Google collects and manages the payment account or card information required to start. We do not receive your full payment-card details. Manage or cancel in Google Play subscriptions.
• In GAIC for Windows from the Microsoft Store, GAIC Pro is billed by Microsoft to your Microsoft account at the price the Microsoft Store shows, and renews until you turn off renewal at account.microsoft.com/services. New subscriptions have no free trial; trials started on earlier add-ons keep their terms. A Microsoft Store subscription unlocks Pro in GAIC for Windows only; it is not linked to your GAIC account.
• On the web: The new web annual plan costs US$21.99, billed upfront for one year, and automatically renews yearly at US$21.99 until canceled, with no subscription trial. That saves US$1.89 (7.91%) compared with US$23.88 for twelve US$1.99 monthly payments. On the web, the new GAIC Pro monthly subscription costs US$1.99 per month, charged at confirmation and renewed monthly until canceled, with no subscription trial. Creating an account requires no card. Stripe collects payment details; GAIC does not receive your full card details. We retain customer, subscription, payment-status and transaction identifiers to activate, restore and manage access. Pro provides unlimited checks, with no daily, weekly or total limit. Advanced Scan, an optional cloud second opinion, is available only to subscriptions bought on gaicheck.com, only when it is offered, and only with separate consent; it is not available today. Existing subscriptions and trials retain their agreed terms. Use Manage Pro to review or cancel billing.

The native receipt-validation SDK is configured to send the store-signed transaction without its optional analytics, support, fraud-device, or tracking metadata. It does not attach an advertising ID, persistent device ID, device fingerprint, model, manufacturer, or operating-system details to NIRO's validation request.

Service logs, retention, and deletion

Hosting, security, queue, inference, billing, and app-store providers may create operational records such as request time, route, response status, IP address, device or user-agent information, opaque job identifiers, and transaction identifiers. They retain these records under their own security, fraud-prevention, accounting, service, and legal policies. QStash receives only opaque orchestration data for a cloud job; the configured inference provider receives the separately consented image.

• Clear GAIC site/app data or uninstall the app to remove the local usage counter, cached entitlement data, and pending referral attribution. Android and iOS delete each temporary native-entry image after handoff and clear stale copies when the native bridge next starts.
• Use Privacy choices in the checker to change the locally saved analytics preference. Choosing No thanks stops future analytics even if storage is enabled in a later disclosed release.
• Leave the optional cloud box off to withhold consent for future uploads. A request already delivered to an inference provider cannot be recalled, although GAIC still applies the encrypted-payload deletion schedule above.
• Delete your account and its data — if you created a GAIC account, open the account panel and choose Delete account. Confirming permanently removes your account record, including your email address, stored usage count, native iOS/Android entitlement state, extension connection/revocation ledger, and remaining GAIC-controlled cloud job and encrypted-payload records, from our systems. For a web subscription, deletion first cancels the Stripe subscription, expires any open GAIC Checkout Session, and removes the associated Stripe customer and payment details from GAIC's active billing account. Account deletion also revokes your referral links, removes their landing records and your scan-consumption journal, and clears your bonus balance. Minimal one-way deleted-account references and reward-award records are retained to prevent duplicate grants; bonus scans already earned by another sharer are not revoked. Deletion does not cancel a subscription billed by Apple or Google, and mobile paid access cannot be restored to a deleted GAIC account. Cancel the native subscription in App Store or Google Play settings before deleting the account. Queue, inference, hosting, and billing providers may retain limited operational, transaction, accounting, fraud-prevention, security, service, or legal records under their own policies. This cannot be undone, and it does not require emailing us.
• GAIC has no saved-content library. For billing identifiers, an operational-log inquiry, or deletion of data we control where legally and technically possible, email support@gaicheck.com.

What we don't do

We don't sell submitted content, use it for advertising or cross-app tracking, or intentionally use it to train models. GAIC does not store cloud-uploaded images in plaintext: it keeps only the temporary encrypted payload described above, makes it accessible to the job for up to 15 minutes, deletes it on completion or failure, removes expired records through bounded cleanup, and keeps no saved-content library.

Children

GAIC is not directed to children under 13. Children under 13 should not use the service or submit personal information, text, images, video frames, or screen frames to its optional cloud feature. If you believe a child under 13 provided personal information to GAIC, email support@gaicheck.com so we can investigate and delete information we control where required, subject to identity verification and any legal retention obligation.

Contact

Questions? See Support or email support@gaicheck.com.

Last updated: October 11, 2026.