Privacy
What we process to deliver a gated, show-only document, why, and your rights. The data controller's contact details are on the contact page.
1. Viewer email
To gate access to a shared document we process the email address a viewer enters solely to check it against that document's access list and, if it is listed, to send a one-time sign-in code or link to it. We do not use a viewer's email for marketing, and we do not share it with the document's publisher beyond what the publisher already entered when granting access.
2. Account data
For people who publish, we process the account email, workspace and display name, chosen plan, and — for paid plans and add-ons — the billing records needed to provide the service, via our payment provider, and to meet our tax and accounting obligations.
3. Access logs and analytics
We record when an allowlisted viewer opens a document — the time, and a salted, one-way cryptographic hash of the IP address rather than the address itself — so the document owner can see who has viewed it, plus coarse metrics such as "time on document" (the plan's tier controls how much analytics detail is shown). We do not store or display raw IP addresses; the hash uses a secret, deployment-wide salt, so it cannot be reversed back to the original address and cannot on its own be matched against a different site's records.
4. Audit log
On plans where analytics capture is enabled, and always for security-sensitive actions (such as an operator disabling a document or account), we keep an append-only, tamper-evident audit log of views and account actions — who, what, when — as our record for security, abuse investigation, and accountability. See section 5 for how long audit records are kept and when they are deleted.
5. Legal basis
We process this data to perform our contract with you (delivering and gating your shares), on our legitimate interest in securing the service and investigating abuse (the audit log), and to meet legal obligations such as bookkeeping for billing records. Because we set no advertising or cross-site tracking, there is nothing here that requires separate consent.
6. Retention and deletion
A document and its view analytics are removed once the share expires, unless the account has the extended-archive add-on, in which case the document and its audit log stay available to the account owner only (never to recipients) for the add-on's chosen window, measured from the share's own expiry, after which they are purged. Deletion otherwise works differently depending on who acts and why:
— When you delete your own workspace, we treat that as a full, irreversible erasure request: we permanently delete everything tied to the account, including its documents, audit log, and billing records, with no retention. Download anything you need — including your audit log — before you do this, because it cannot be recovered afterwards.
— When a single team member is removed from a shared workspace by its owner, or when we act on a report or abuse investigation (for example, disabling a document or an account), we keep the relevant tamper-evident audit record for a limited period even though the member or document itself is gone. This is on the basis of our legitimate interest in security and abuse prevention, and, for billing-related records, our legal bookkeeping obligations. It exists so the record an abuse investigation or a dispute might need cannot simply be deleted by the party being investigated.
You may request access to, correction of, export of, or deletion of your personal data at any time via the contact page; where deletion would remove an audit record kept under the previous paragraph, we will explain why and delete what we lawfully can.
7. Where your data is held and who else sees it
Data is held in a private, EU-hosted environment and stays in the EU. Our current processors are our EU infrastructure/hosting provider (Hetzner, Germany), our transactional email provider (Brevo, for sign-in codes, magic links, and account notifications), and our payment provider (Mollie, for paid plans and add-ons). We use no advertising or third-party analytics providers, and we do not sell personal data. The hosted page itself runs inside the show-only sandbox described in our Terms and cannot collect or transmit any data on its own, whatever it contains.
8. Your rights
Subject to applicable law, you have the right to access, correct, export, or delete your personal data, to object to or restrict our processing, and to lodge a complaint with your data-protection supervisory authority. Contact us via the contact page to exercise any of these rights.
9. Cookies. We set only strictly necessary cookies: a sign-in / viewer-session cookie that keeps you authenticated to the dashboard, or to a document you have been granted access to, and a short-lived cookie used only to show an on-screen status message after an action. We set no advertising, analytics, or cross-site tracking cookies — so there is nothing optional to ask your consent for. The hosted page itself is sandboxed and cannot set cookies of its own. See the cookie policy for the full detail.