Privacy.

Deniz Can Adigüzel

Gereonshof 49 50670 Cologne Germany

Email: support@removeclaudewatermark.net

Technically necessary connection data is processed when you open this website. It may include your IP address, the time of access, requested URL, HTTP method and status, transferred data volume, referrer, browser and operating-system information.

This processing is necessary to deliver the website, maintain stability and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this service.

Hosting provider

STRATO GmbH

Provider address

Otto-Ostrowski-Straße 7, 10249 Berlin, Germany

Processing location

Germany

Log retention

7 days

The hosting provider receives and processes this data as necessary to operate the service, including as a processor acting on our instructions where applicable.

Your text and selected removal mode are sent to this website's server only when you activate the Claude watermark remover. In Careful mode, the server uses only a rule-based pass to remove supported hidden Unicode outside emoji sequences, preserving emoji joiners and presentation selectors. It does not deliberately rewrite visible words and does not send the text to OpenAI.

If you explicitly select Thorough mode, the original submitted text and fixed rewriting instructions are sent server-to-server to the OpenAI API first. OpenAI returns a rewritten version intended to remove the hidden Claude wording pattern. The server then removes supported hidden Unicode characters from that rewritten text and creates the final report. The application does not send the source filename, guest cookie, random guest identifier or IP address as part of the model input.

The application does not create text histories, attach text to an account or write submitted or rewritten text to an application database or file. It is processed in memory for the duration of the request. Separately, the guest and account allowances described below store only identifiers, counters and timestamps; they never store the submitted text.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to provide the processing you explicitly request, minimise data processing and enforce the guest allowance consistently. Supplying the text is necessary to use the remover; the OpenAI transfer occurs only when you select Thorough mode.

Generative output is not deterministic and may change meaning, facts or formatting despite the preservation instructions. Always compare an AI-rewritten result with the source before using it.

Please note: Do not submit confidential information, special categories of personal data or another person's data unless you are authorised to do so.

If you create an account, we process your email address and a normalized form used to prevent duplicate accounts, a salted password hash, verification and account status, an opaque user identifier, security and account timestamps, hashed session and one-use verification or recovery token records, and usage and abuse-prevention counters. We never store your password in readable form. Submitted text and remover results are not saved to or associated with your account.

This processing is necessary to create and secure the account, verify control of the email address, let you sign in and recover access, enforce account allowances, and prevent misuse. The legal basis for providing the account is Article 6(1)(b) GDPR. Security, abuse prevention and service-integrity processing is based on Article 6(1)(f) GDPR; our legitimate interest is protecting users, the service and paid upstream capacity.

Unverified pending accounts older than 7 days are removed during authentication maintenance. Account sessions are valid for no more than 14 days; expired and revoked sessions and expired or used one-use tokens are subsequently removed under the configured maintenance periods. Active account data remains until you delete the account. Account deletion removes the account, its sessions, tokens and account-usage records; it does not reset or merge the separate guest browser allowance.

Verification and password-recovery messages are transactional. They contain a single-use, expiring link. The application stores only a cryptographic hash of that link token, and password resets revoke existing account sessions.

A selected text file is initially read only inside your browser. Its filename is not sent to the server. The text it contains is transmitted only when you subsequently start a removal, as described in Section 3.

Clipboard reading and copying occur only after an action in your browser. Downloads are generated locally by the browser. The application does not persist this information in Local Storage or IndexedDB.

If you contact us by email, we process your address, message and ordinary transmission metadata to answer your request. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is handling your enquiry. Article 6(1)(b) GDPR also applies where your message concerns entering into or performing a contract.

The data is deleted after the request has been resolved unless statutory retention duties or the establishment, exercise or defence of legal claims require longer retention. The email service provider may receive the data as a processor.

When you register, request another verification email or request password recovery, the application sends your email address, the transactional message and ordinary delivery metadata to STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Processing location: Germany. Provider retention: STRATO processes and stores data only for as long as necessary to provide its services or as required by applicable legal retention obligations.. These deployment facts must also cover any separate durable email queue or broker used before delivery.

When you open the remover, the application sets the guest_cleaner cookie needed to apply the guest allowance. It contains a signed, random identifier and lets the server apply the allowance of 10 free removals to that browser. The cookie is HTTP-only, uses SameSite=Lax and remains valid for up to one year. The associated server record contains the random identifier, clean count, creation time and last-use time; inactive records older than one year are deleted during subsequent quota maintenance.

When you open an account form, register or sign in, the application also sets the essential, signed, HTTP-only claude_remover_session cookie. Before login it contains only an anti-forgery value; after login it also contains an opaque session credential, never your password or email address. The server stores only a hash of the session credential so sessions can be revoked. The cookie uses SameSite=Lax, is marked Secure on the public HTTPS deployment, and has a bounded lifetime. The anti-forgery value protects state-changing forms and authenticated API requests.

If you create API keys, the application stores only a cryptographic hash and a short display prefix of each key, never the full secret after creation. Metered API usage records store timestamps, mode and optional Stripe usage-record identifiers—not the submitted text.

Clearing the guest cookie prevents the browser from being matched to its previous counter. The application does not use Local Storage or IndexedDB for recognition and does not embed analytics, advertising, social-media or other third-party scripts. Fonts, stylesheets, JavaScript and images are served by this website. The OpenAI processing described in Sections 3 and 8 is a server-to-server request made only after you select Thorough mode and start a removal.

Google AdSense is not currently integrated. Before advertising is enabled, this notice must be updated and any required consent must be obtained before third-party resources are loaded.

Recipients include the providers used for hosting and email and people who technically operate the service, where their access is necessary. Further disclosure takes place only where required by law.

The VPS is hosted in Germany. Your data remains strictly within the European Union (EU) / European Economic Area (EEA) at all times and is processed in full compliance with the General Data Protection Regulation (GDPR).

Safeguards and information for transactional-email processing outside the EEA: Email data is processed by STRATO in Germany. Delivery to a recipient may involve transmission to the recipient's email provider, which may process data outside the EU/EEA depending on the recipient's provider..

If you upgrade to a paid plan or enable metered API billing, payment is processed by Stripe Payments Europe, Limited (and affiliated Stripe entities as needed). We transmit your email address, an opaque customer identifier, subscription and invoice metadata, and API usage quantities (counts of requests—not the submitted remover text). Stripe acts as an independent controller for payment data and as a processor for some billing operations. See Stripe’s privacy documentation for details. The legal basis is Article 6(1)(b) GDPR for contract performance and Article 6(1)(f) GDPR for securing paid capacity.

When you explicitly select Thorough mode, the original submitted text is also received by OpenAI, L.L.C., 650 F Street NW, Washington, DC 20004, United States, as the OpenAI API provider or processor. Processing location: United States.

The request uses the Responses API with store=false, so the response is not saved as retrievable Responses application state. OpenAI states that API data is not used to train its models unless the API customer has explicitly opted in. Under OpenAI's default controls, abuse-monitoring logs may nevertheless contain prompts and outputs for up to 30 days. Actual deployment retention and project controls: OpenAI's API does not use submitted prompts and outputs for model training by default. Abuse and security monitoring logs may be retained for up to 30 days under OpenAI’s default controls. This application does not keep a separate copy of the submitted text after the request is processed..

Safeguards and information for any processing outside the EEA: The submitted text is transmitted to OpenAI servers in the United States for processing. The transfer is carried out under the applicable OpenAI contractual safeguards and data-processing terms for international transfers. This application does not retain the text beyond the processing needed to complete the requested rewrite..

See OpenAI's API data-controls documentation for details. The configured provider, region, contract and transfer safeguards must be verified against the actual deployment before publication.

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Article 22 GDPR. Careful mode is rule-based. Thorough mode uses generative processing only to produce the text variant you request before the Unicode pass; it is not used to evaluate or make decisions about you.