Privacy notice

When you create an account and use the site, we keep:

• Your account — your name, your email address, and your password as a one-way hash. The password itself is never stored and cannot be recovered from the hash.
• Your sign-ins — a random token for each device you are signed in on (stored hashed), when it expires, and which browser it came from. Sessions last 30 days.
• Templates you upload — the file itself, cleaned of anything that could run, and the list of fields found in it. Once your account has been approved, your templates are visible to every other user and on our front page, with your name shown as the uploader. Before that they are visible to you and to administrators.
• Copies you fill in — the values you type into a template and the name you give the copy. These are private to you.
• Password-reset links — when you ask for one, a random token (stored hashed) that expires after an hour and works once.
• Messages you send us — through the contact form: your name, your email address and what you wrote, and which account you were signed in to, if any. Kept until we have dealt with it and delete it.
• Rate-limit counters — short-lived tallies of sign-in attempts, sign-ups, uploads and exports, kept for at most 24 hours to stop abuse. Some of these are tied to your account. The rest, for things you do before signing in such as signing up or asking for a password reset, may be tied to your IP address instead.

One cookie, rs_session, keeps you signed in. It holds a random token and nothing else. There are no analytics, no advertising, no tracking pixels and no third-party cookies.

We send you exactly one kind of email: a password-reset link, and only when you ask for it from the sign-in page. It goes out through Resend, an email delivery service, which handles your email address for that purpose alone. There is no newsletter and no marketing.

Anything inside a template you upload becomes visible to other users once your account is approved: names, addresses, amounts, whatever the document contains. Only upload documents with real people’s details in them if you are entitled to share those details. If a template links to an image hosted elsewhere, anyone who views it fetches that image straight from where it is hosted, and so does our own PDF renderer when it exports a copy. The host serving the image sees each of those requests.

• Other users see your approved templates and your name as their uploader. They never see your email address, your copies, or anything about your account.
• Our administrators can see every template, including ones not yet approved, and every account’s name and email address; they can also remove templates and accounts. They cannot see your password.
• Nobody else. We do not share or sell anything about you.

• Your account, for as long as it exists.
• Sessions, until they expire after 30 days or you change your password, which signs out every other device.
• Password-reset links, for an hour, or until used.
• Rate-limit counters, for up to 24 hours.
• Messages you send us, until we have dealt with them and delete them.
• Templates you uploaded, until you or an administrator remove them. Copies other people filled in from your template stay with them.
• If your account is deleted, your saved copies are deleted with it. Templates you uploaded remain in the library, credited to a deleted account, unless an administrator removes them.

• You can rename or delete your copies, remove templates you uploaded, and change your password from your account page.
• You can delete your account from your account page. Your saved copies go with it; templates you uploaded stay in the library, credited to a deleted account, unless an administrator removes them.
• To see everything we hold about you, or to correct it, ask us.

We use your account, sessions, templates, copies and password-reset links because they are necessary to provide the service you signed up for. We use rate-limit counters because preventing abuse of the site is a legitimate interest. We do not use any of it for advertising or profiling.

Resend, the email service we use for password-reset links, is based in the United States. Sending you that email can mean your email address is processed there.

You can complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator, or to the data protection authority where you live, without asking us first.

We hash passwords with scrypt, strip uploaded files of scripts and anything else that could run, then store and show them inside a sandbox. We designed the site to be served over HTTPS. No system is perfectly secure; if you believe something has gone wrong, write to us.

If we change this notice, the date at the top changes with it. We will make it clear on the site if what we collect or how we use it changes.