Privacy policy

What never leaves your browser

The PDF you open, the bytes of the file, the text on its pages, the marks you place, the copy you export and the copy of the text the OCR engine produces never leave your browser — except for the name and the size of your document and your marks, which go into a share link, and that is described below. No request this site makes carries any of them, and the site has no upload endpoint for documents.

• The file you open, and every byte of it.
• The text on its pages, whether it was read from the file or recognised by OCR.
• The name and the size of your document, the marks you place, and the text of the marks — unless you put them in a share link, which is described below.
• The copy you export.
• The recognised text, which is stored in your browser's own IndexedDB and is never sent to us.

What does leave your browser

Five things. None of them carries the content of your document. The closest any of them comes is the size of a file in a coarse bucket.

• Sign-in. If you create an account, your email address and your password are sent to this site's server, which passes them straight to our authentication provider, Supabase, which stores a hash of the password rather than the password itself. If you sign in with Google, Google handles the sign-in and tells us your email address, and the name on your Google profile, which we keep with your account so the app can show you who you are.
• Usage events. The app records which features are used. Today that means three things: a click on a link, a PDF being opened in the editor, and an export finishing (or failing) — in the second case only the size of the file, in a coarse bucket rather than exactly, never its name or its contents, and in the third case nothing about the document at all: not its name, not its size, not its contents. Each event carries a random identifier that is regenerated on each page load, and the server's timestamp; a click also carries the path of the link that was clicked and a short, fixed name for the button. The events are anonymous unless you are signed in, in which case they are attached to your account. They never contain document content.
• Hosting. The server that hosts this site sees the IP address and user agent of every request. It is never sent the document itself, and we do not record page views.
• A rate-limit counter. To stop one client flooding the site, we count the requests made from your IP address, and for signing in and signing up we count them against your email address as well. The window is 1 minute for usage events, 15 minutes for signing in, and 60 minutes for signing up. Neither your address nor your email address is stored: only a one-way hash of each, which is used to count the requests. The hash cannot be reversed into the address, but an email address is easy to guess and a hash of one can be matched against a list of addresses, so we treat the hash as though it were the address itself. The counters are written to a table in our database and are discarded within a few hours of the last request. They record which limit was reached, and nothing about the document.
• A payment, if you buy a Single token. You are sent to Stripe's own page to pay, and what leaves your browser is your email address, what you paid, and the fact that you paid. The card details are typed on Stripe's page and go straight to Stripe: no card number reaches this site, and nothing about your document goes with them. We keep the email address you gave Stripe, and only to find your purchase again if you write to us about it.

The share link

The app can encode the name of your document, its size, and your marks into the fragment of the page's own address, so that a link can carry them: where each mark is on the page, what kind of mark it is, and, for a mark the scan found, the text it covers. A browser never sends the fragment of an address to a server, so this does not reach us. It does mean that anyone you send the link to can read what is in it. Do not share a link you would not share the file itself.

Cookies

The site sets a cookie when you sign in, and a second one while a Google sign-in is in progress.

• __Host-auth_token — holds your session. It is httpOnly, so scripts cannot read it; Secure, so it is only sent over HTTPS; and SameSite=Lax. It lasts 30 days.
• oauth_state — a random value that ties a Google sign-in to the browser that started it, so that another site cannot finish the sign-in on your behalf. It is httpOnly, Secure and SameSite=Lax, and it is deleted as soon as the sign-in finishes, or after ten minutes.

Who processes what

We use a small number of providers, each of which sees only what its part of the product needs.

• Supabase — authentication, and the storage of your account record (your email address, and the name Google gives us if you sign in with Google), the usage events, the error reports and the rate-limit counters.
• Our hosting provider — the server that runs this site, which sees the IP address and user agent of every request.
• Google — only if you choose to sign in with Google.
• Stripe — the payment processor, and only if you buy a Single token. It takes the card details on its own page and sees your email address and what you paid; we keep only the email address, so that we can find your purchase if you write to us.
• Tesseract — the OCR engine, which runs inside your browser. Its engine, its WebAssembly core and its language packs are served from this site rather than from a third party, so no third party learns that you used OCR.

How long it is kept

Usage events and error reports are kept while the service runs. The rate-limit counters are discarded within a few hours of the last request they count. Account data is kept until you ask us to delete it. A record of a Single purchase — the email address you typed at checkout, and the fact that you bought one — is kept until you ask us to delete it too, and it is what we use to find your purchase if you write to us. We do not keep documents, because we never receive them.

Your choices

You can use the whole editor without an account. If you have one, you can ask us for a copy of the information we hold about you, or ask us to delete it — write to the address at the foot of this page. The editor itself needs nothing from us, so deleting your account does not affect it.

Changes to this policy

If this policy changes, the date at the top changes with it, and this page is the notice. There is no separate list of versions.

Contact

Write to the address published at the foot of this page.