Privacy policy

Version 2026-11-06, effective 2026-11-06. It covers the services of elamur.ai: the Mova parse service with its API and MCP server, translate, the dictionary and research, and the account (the cabinet) they share. The Terms of use go with it.

Who runs it

The services are run by the Elamur team. For questions, corrections or deletion of your data, write to the contact address shown in the footer of this page.

What is collected, by service

Mova parse service (page, API and MCP server)

Texts you send and their analyses. Every parse is written to a request log: the time, the page or endpoint, the method, the language chosen, the size in characters and words, the status, the time taken, whether the cache answered, the text itself and, when you are signed in or use an API key, your account id. The log has no IP address. Day files are compressed into daily archives and every archive is removed after 90 days.
Recent results. The analyses of the last 20 texts, which include the texts, in a ring where each result is overwritten by a later one. Kept until overwritten, usually minutes to hours.
Short links. A text too long for an address is stored with its language under a short link, so that the link, and the same analysis served by the API in other formats, keeps working. At most 20,000 links are kept and none longer than 90 days.
Word counts. To apply the daily limits the service counts words per client: for anonymous use by IP address, for a signed-in account by account id. The counts, with the IP addresses, are stored in a file per day (plain, not hashed) and kept for 2 days (today and yesterday). A short-lived rate limiter also holds your IP address in memory only. The service reads the address from the connection, or from the reverse proxy in front of it.
Usage counts. Aggregate numbers of requests, cache hits and words, with no text and no address.
The web server and the reverse proxy in front of the services may keep a standard access log (time, address, page) for operating and securing the site.

Account (shared by all services)

The Google account id (the OpenID Connect subject), the verified e-mail address and the display name Google shares when you sign in, the time the account was created, the terms version you accepted and when, the plan tier, and your API keys: a hash of each key (the check uses only the hash), its first characters, your label and its creation time, and a copy of each key encrypted with a secret kept on the server apart from the account data, which only your signed-in session can decrypt, to show it to you in the cabinet and in the examples of the API and MCP pages. Sessions are stored only as hashes and last 30 days. Kept until you delete the account.

Translate, dictionary, research

These services use the same account. This page is updated, and its version changes, before any of them collects more than the standard access log of the web server.

Cookies and analytics

There are no advertising or tracking cookies. The sign-in uses a session cookie (secure, not readable by scripts, valid for all of elamur.ai so that one sign-in serves every service), and short-lived cookies of the sign-in form (a CSRF check, the state of the Google sign-in and the page to return to). A second cookie, elamur_who, is readable by the page's script: it holds only a short label (your first name, or the first part of your e-mail address) so that the header of every elamur.ai page can show who is signed in instead of "Account". It lasts as long as the session and is removed when you sign out or delete the account. The pages may load the Ahrefs Web Analytics script from analytics.ahrefs.com, which our content security policy allows: it measures visits to the site (pages, referrers, country, device), as site analytics, and we use it to understand how the site is used.

Why

To run the services; to apply the limits and keep the services fair and safe from abuse; to measure and debug them; and to improve Mova. Texts you submit to the parse service may be read by us and used to test and train Mova's models and corpora. If you do not want that, do not submit the text. Your e-mail address is used only for the account itself: no newsletters, no marketing mail.

Sharing

We will not sell users' information and do not give it to advertisers. Google processes your sign-in under its own privacy policy (we get the account id, e-mail address and name only). Our hosting provider and network operators handle the data to run the services. We share data with others only when the law requires it.

Retention

Request log and its archives, and short links: 90 days. Word counts with IP addresses: 2 days. Recent results: until overwritten. Sessions: 30 days. Account and keys: until you delete the account. Backups, if any, follow the same limits.

Your rights

You can see your account data on the account page, revoke keys and sign out there, and delete the account, its keys and its sessions at once on the delete page (the "Delete my account…" link at the bottom of the account page), which also says what is kept. For a copy of data about you, to correct it, to have texts you sent removed from the request log before the 90 days pass, or to object to a use, write to the contact address in the footer; in the European Union you also have the rights of the GDPR, including to complain to your data protection authority. The log is searched by account id or by text, so for anonymous use tell us the text.

Children

The services are not for children under 13, and where the law sets a higher age of digital consent (up to 16 in some countries of the European Union) not without a parent's consent. Do not create an account if you are younger.

Changes

This policy has a version (above). When it changes materially, the version changes and the new text is shown here; if the Terms of use change, you are asked to accept the new version at your next sign-in.