Privacy Policy

Last updated: November 2, 2026

MisalignAI is an independent website at misalignai.com. It publishes in-browser safety checks and original guides about those checks. You can run a check without an account. If you sign in, you can choose to save that result. This policy describes the check, the optional account, what a saved scan contains, what the host and the advertising script can see, and what this site does not collect.

Who operates the site

The site is published by MisalignAI. Privacy questions go to privacy@misalignai.com. Optional sign-in uses Supabase Auth with Google or email and password. There is no separate data-protection portal. To delete a saved scan, use scan history while signed in, or email that address. The about page describes what the publisher writes and what it does not claim.

Text you paste into a checker

The prompt injection scanner, the jailbreak detector, and the model-output checker run as JavaScript in your browser. Running a check does not upload the text, does not put it in the address bar, does not write the paste to local storage, and does not send it to a language-model API. The text sits in the page’s memory until you clear the box, navigate away, or close the tab.

Saving is separate, and it is off unless you do it. After a check, a signed-in visitor can choose “Save to history.” The default save stores the tool name, the score, a short summary of the findings (titles and explanations, not the evidence quotes), and a short preview of the paste. The full paste is stored only if you check “Also store the full paste.” That box starts unchecked. A stored paste is capped at the same 20,000 characters the checker reads. You can delete a saved row from scan history. Saved scans are not used to train a model.

That is not the same as “nobody can see the screen.” Anyone with access to your unlocked device can read the page. A browser extension can read the page. The check also stops at the first 20,000 characters, which is a product limit described in the guide to the scores, not a privacy guarantee about the rest of the document.

Tool pages and guide pages load Google AdSense. Our code does not add the contents of the text box to the advertising request. A third-party script that runs in the same tab can still read what is on the page, including text you have typed. Do not paste a live password, a customer secret, or a production API key into an ad-supported page to “see what the checker says.” Revoke a key that has already leaked, and review sensitive text in an environment you control. The guides name the rules in plain language, so you can compare a sentence with that description without pasting the secret.

About, contact, privacy, terms, the newsletter page, log in, sign up, and scan history do not load the AdSense script. The homepage, the tools, the guides, and the older library pages do.

What this site stores on your machine

The theme control writes one value, theme, to local storage so the next visit can open in light or dark. That value is not an analytics identifier.

A signed-in session is stored in this browser by the Supabase client, in local storage. That record is the login session, not the text you pasted. MisalignAI does not run a first-party analytics product.

Each successful check also updates a counter in local storage for the current calendar day. The counter is a number. It does not contain the paste. It is a reminder in this browser only. It does not block the tool. The site does not yet enforce an anonymous daily limit on the server. If that limit is added, it will be a separate Worker and this page will say so.

Hosting

The static files are served over HTTPS by Cloudflare Pages. Loading a page creates an ordinary request. The host can see connection data for that request, such as IP address and user agent. The text you type into a checker is not part of that request, because the checker does not submit it.

If you sign in or save a scan, the browser talks to Supabase over HTTPS. That request includes your session and, only when you save, the history row described above. Sign-in is Google OAuth or email and password. There is no magic-link or one-time code form. Cloudflare’s and Supabase’s handling of their own logs is described in their documentation, not in this policy.

What MisalignAI does not collect

The checkers do not require an account. Email and password accounts, and Google sign-in, exist so you can optionally save a scan. There is no payment, no team workspace, and no training program attached to a free account. Email you send to contact@misalignai.com or privacy@misalignai.com is ordinary mail to those inboxes. Do not include a live secret in that mail. A useful correction names the rule and includes a redacted sentence.

• Advertising data may be processed by Google AdSense when ads are shown on a content page. The publisher id in use is the one published in ads.txt. This policy does not change it.
• Email addresses are collected when you create an email account or when Google provides an email through sign-in. The newsletter form still does not store addresses until a newsletter endpoint is configured and this policy says that it is.
• Account data is the auth account and the scan rows you choose to save. We do not collect payment card data, and we do not sell personal information. The full paste is not stored unless you opt in on that save.

Advertising

Google AdSense is the third-party service the static frontend loads for advertising. The script is injected in the browser only on content routes. It is not hardcoded in the site’s HTML shell. AdSense may use cookies or similar technologies under Google’s advertising technologies policy. You can control ad personalization from Google ad settings and from your browser.

Ads are labeled by the ad component. They are not endorsements of a model vendor, and they are not part of the checker. The checker’s result does not depend on whether an ad fills.

Your choices

Clear the text box when you are done, especially on a shared computer. Leave “Also store the full paste” unchecked unless you want the body kept. Delete a history row from scan history. Sign out from the header to remove the session from this browser. Signing out does not delete saved scans. Use the browser’s controls for third-party cookies if you do not want advertising cookies. There is no billing portal, because the site does not take payment.

Security

The static site is served over HTTPS through Cloudflare Pages. Account traffic uses HTTPS to Supabase. Database policies limit a signed-in user to their own profile and scans. The browser uses the publishable anon key, not a service-role secret. The checkers are not a security product you can point at someone else’s system. They review text you choose to put in the box.

Changes to this policy

Running a check does not store the paste. Storing a paste requires a signed-in visitor to opt in on that save. If that default changes, this page will say so before the new behavior ships. The date at the top is the date of the current text.

Contact

Questions about this policy: privacy@misalignai.com. Corrections to a guide or a checker: contact@misalignai.com.