Currently in use
These are the providers the running service depends on today. Each receives only what the entry names.
- Hosting, storage, database and backups — our own servers, in Canada. They store uploaded PDFs, the unlocked copy of any password-protected PDF, exports, account records, logs and backups. No third-party cloud stores your documents.
- Content delivery and DNS — Cloudflare, Inc., United States, with a worldwide network. Every request to the site passes through it, including uploads and downloads, so it processes your IP address and the contents of requests in transit. It does not store your documents. When you create an account, or upload for the first time without one, its Turnstile check runs in your browser to tell a person from an automated script; it sends Cloudflare information about your browser and device for that purpose only.
- Transactional email — Resend, United States. Your email address, the message and delivery records, for verification codes, password resets and account mail.
- Sign-in with Google — Google LLC, United States. Only if you choose it: Google tells us the identifier it issues for your account, and the email address and name on it. Google handles your Google account under its own privacy policy.
- Product analytics — PostHog, Inc., United States. It receives data by two routes. In your browser on public marketing pages, only if you accept analytics cookies, it records which public pages are viewed. From our server, whatever your cookie choice, it receives the product events described in the privacy policy: identifiers, counts and labels from a fixed list, keyed to a random workspace identifier, with no name, email address, IP address, document content or file name. Automatic capture of what you click and screen recording are both switched off.
- Website analytics — Google Analytics, Google LLC, United States. Only on public marketing pages, and only if you accept analytics cookies. It receives the address of the public page you are on, the site that referred you, an approximate location derived from your IP address, and your device and browser. It is not loaded on the editor, your document pages, sign-in or these legal pages, so it never receives the address of a private page or anything about a file you upload.
- Payments — Stripe, Inc., United States, and its affiliates. Paid plans are sold through Link, a service of Stripe, as the seller of record. Stripe holds the customer and subscription records we use to run your plan, on our behalf, and receives your account's email address and an internal identifier for your workspace. For the payment itself — your payment details, which go to Stripe directly and never through our servers, the tax it collects and pays, and your Link account — Stripe acts under its own terms and privacy policy, not on our instructions.
Planned, not yet enabled
None of these receives any data today, and this page will be updated before any does.
- Advertising — Google AdSense on public marketing pages. The code is in place but not switched on, so no ad is served and no ad network receives anything from this site.
- Font identification — a paid-plan feature that would ask a language-model provider to classify font names the built-in catalogue does not recognise. It would send font names and the style flags stored with them, never your document's text, file name or page images. No provider is configured, so it is not used.
- Error monitoring — no provider has been chosen. Errors are recorded in our own logs, with download links stripped.
Changes
Before adding a provider we assess its security, privacy, location and retention practices. We update this page before the provider begins processing data, not afterwards. To be told about changes, email [email protected].