Privacy Policy

• Account data: name, email address, email-verification status, account identifier, creation and update timestamps, and an optional profile image URL.
• Authentication data: the authentication provider and provider account identifier. For email/password accounts, the password is stored using the authentication library's secure cryptographic hashing, not as plaintext.
• Session and security data: a server-side session identifier, session creation/update/expiry timestamps, IP address, and user-agent string. The browser also receives a necessary session cookie.
• OAuth account data: the provider access, refresh, and ID tokens and their expiry metadata may be stored server-side by the authentication implementation when returned by a provider. They are not displayed in the application.
• Workspace data: folder and document names, hierarchy, icons, colors, favorites, ordering, timestamps, revision metadata, file type, size, hash, and cloud document content when you choose cloud synchronization.
• Email-delivery data: the email address, verification or account-deletion confirmation purpose, provider message identifier, delivery status, timestamps, quota date, and limited provider error information.
• Operational data: request identifier, endpoint, method, status, duration, user identifier when available, IP address, and bounded sanitized request/response or error information used for security and troubleshooting.

• IndexedDB database md-pdf-preview: local workspace items and metadata, retained until you delete them or clear browser site data.
• localStorage key theme: selected visual theme, retained until cleared.
• localStorage keys md-pdf-preview:zoom-preferences and md-pdf-preview:desktop-sidebar-collapsed: selected editor and layout preferences, retained until cleared.
• sessionStorage keys md-pdf-preview:scroll:*: temporary scroll-position restoration, normally ending with the browser tab or session.
• NEXT_LOCALE cookie: remembers the language selected in the locale switcher; it is a session preference.

• The default session lifetime in the current configuration is up to 7 days, subject to sign-out, expiry, and any future deployment settings.
• An OAuth state cookie is used briefly to protect the Google or GitHub sign-in flow from request forgery; its configured lifetime is approximately 10 minutes.
• Verification records contain an identifier, a verification value, and an expiry time. They are used only for email verification and are not a marketing mailing list.

• Scopes actually requested: openid, email, and profile.
• Data used by the application: Google's subject/account identifier, name, email address, profile image URL, and email-verification claim.
• No Google data is used for advertising or profiling by this application.

• Scopes actually requested: read:user and user:email.
• Data used by the application: GitHub user identifier, name or login, avatar URL, email address, and the primary email's verification status.
• No repository content or repository permission is requested by the current implementation.

• Creating and managing an account, authenticating you, verifying your email, and providing cloud synchronization: Article 6(1)(b) GDPR, performance of the service requested by you.
• Maintaining sessions and protecting accounts, preventing abuse, applying rate limits, and investigating security incidents: Article 6(1)(f) GDPR, the Controller's legitimate interest in operating a secure service.
• Sending a verification email that you request: Article 6(1)(b) GDPR, because it is necessary to activate the requested account.
• Keeping records required by law, where a legal obligation applies: Article 6(1)(c) GDPR.
• Optional analytics, advertising, or profiling: none is currently configured. If introduced, it will be blocked until a valid consent mechanism is available and consent will be withdrawable.

• Cloudflare: Cloudflare Workers, through OpenNext, runs the Next.js application and server-side API functionality. Better Auth runs server-side in the same Worker and connects through Cloudflare Hyperdrive to the hosted service's Supabase PostgreSQL database. Cloudflare R2 stores cloud document objects and applicable diagnostic and storage data; its R2 configuration uses Cloudflare's WNAM jurisdiction / North America location configuration.
• Supabase: provides the managed PostgreSQL database. Account, authentication, session, email-delivery, workspace, and operational records are stored in PostgreSQL. The production database is hosted on AWS in the us-west-1 region (United States).
• Oracle Cloud: a separate Go backend runs on Oracle Cloud infrastructure in Phoenix, United States. It supports workspace persistence, Cloudflare R2 presigned URLs, and related server functionality.
• Resend: sends email-verification and account-deletion confirmation messages and processes the recipient email, name, relevant link, delivery metadata, and webhook events.
• Google: receives OAuth requests and returns identity claims only when you select Google sign-in.
• GitHub: receives OAuth requests and returns profile and email data only when you select GitHub sign-in.
• The hosted service uses Cloudflare, Supabase, Oracle Cloud, Resend, and, when you choose those authentication methods, Google or GitHub.

• Local browser data: until you delete it, clear site data, use private browsing, or the browser removes it.
• Account and workspace data: while the account remains active. Authenticated users can permanently delete their account from application settings; this deletes the cloud workspace and associated Cloudflare R2 document objects.
• Sessions: the configured session expiry is up to 7 days by default, with earlier deletion on sign-out or account deletion.
• OAuth tokens and account links: while needed for the linked authentication account, subject to provider revocation and account deletion procedures.
• Verification records and email-delivery records: verification records have an expiry field; PostgreSQL email-delivery records are automatically deleted after 30 days.
• Operational logs: PostgreSQL request logs are automatically deleted after 30 days. Diagnostic log objects stored under the Cloudflare R2 logs/ prefix are also configured to expire automatically after 30 days.
• Backups: where provided by the hosting provider, may temporarily retain deleted information according to the provider's backup lifecycle; they are not active application data, and no specific deletion timeframe is promised.

• Access: receive a copy of personal data being processed.
• Rectification: correct incomplete or inaccurate data.
• Erasure: request deletion where the legal requirements are met.
• Restriction: ask the Controller to limit processing in the situations defined by the GDPR.
• Portability: receive certain data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interests, including for reasons related to your situation.
• Complaint: contact a supervisory authority, especially the Garante per la protezione dei dati personali if you are in Italy.

The Italian supervisory authority is Garante per la protezione dei dati personali.