Plain Search requires no account, never connects to your mailbox and never reads any of your emails: it turns text you type into a search query. This document describes the personal data processing that exists nonetheless, an IP address being personal data.
| Processing | Data | Legal basis / duration |
|---|---|---|
| Access logs | IP address, user agent, requested address, timestamp | Legitimate interest (security, diagnostics); rotating files of limited size (5 files of 10 MB) |
| Translating a request | The text you type, sent to the language model | Performance of the requested service. Processor: Anthropic (see §4). Plain Search does not keep this text. |
| Anti-bot protection | Token and technical browser signals; IP address sent to Cloudflare for verification | Legitimate interest (anti-abuse). Processor: Cloudflare Turnstile |
| Rate limiting | Salted fingerprint of the IP address, kept in memory only | Legitimate interest (anti-abuse). Never written to disk |
| Spending cap | Aggregate counters (number of calls, volume processed, cost), unrelated to any person | Legitimate interest. No personal data |
| Audience measurement | Page views, referrer, with no cookie or persistent identifier | Cloudflare Web Analytics; see §3 |
A single cookie is set: plainsearch_turnstile, when the anti-bot check succeeds. It contains only a signed expiry date, no personal data, lasts 24 hours and avoids presenting the challenge on every request. It is strictly necessary for the security of the service and, as such, exempt from consent.
No advertising or tracking cookie is used. Audience measurement (Cloudflare Web Analytics) works without cookies or persistent identifiers. Cloudflare's anti-bot service is covered by its own privacy policy.
Translating a request relies on a language model provided by Anthropic, a company established outside the European Union. The text you type is sent to it for that sole purpose. Cloudflare, which provides the anti-bot check and audience measurement, is also established outside the European Union. These transfers rely on the GDPR mechanisms these providers implement; see their privacy policies.
Under the General Data Protection Regulation, you have the right to access, rectify, erase and port your data, and the right to object to its processing. To exercise these rights, contact contact@nm-labs.dev.
You may also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
Last updated : October 2026.