Privacy policy

At a glance

• Files you open in a tool are processed on your device. They are never sent to us or to anyone else.
• There are no ads, no analytics, no tracking pixels and no code from other sites on Staydoc.
• The tools set no cookies. If you sign in, two cookies keep sign-in working, and nothing else.
• An account is optional. If you create one, we hold your name, email address and sign-in details, and you can delete them at any time.
• We never sell personal data or use it for advertising.

Who we are

Staydoc is an independent, personal project run from India. In this policy, “we” and “us” mean the person who runs it. For the account data described below, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the controller under the EU and UK General Data Protection Regulation.

You can reach us at [email protected].

Your files

When you use a tool, your browser reads the file into the page's memory, the tool runs on your device, and the result is saved to your device by your browser. We never receive those files, their names, their contents, the text recognised in them, or the passwords you type into a tool.

The site's security policy stops the page from sending anything to another site, and our server accepts no uploads. The privacy proof explains how to check this yourself, with the network captures from our tests for each release.

If you install Staydoc and share files to it from another app, your device hands them to the app's offline worker, which keeps them on your device until you choose a tool, then deletes them. The privacy proof describes the one exception, just after you clear this site's data.

When you visit the site

To send you a page, the servers of the company that hosts this website receive what every website receives: your IP address, the address of the page, and details your browser sends such as its name and version. The host may keep these in short-lived logs for security and reliability. They never include your files.

We add nothing on top of that: no analytics, no advertising and no tracking. Tools download their engines from this site too, so opening a tool doesn't tell any other company that you did.

If you create an account

You don't need an account to use any tool. If you choose to sign in with Google, this is what happens.

• What Google tells us: a number that identifies your Google account, your email address, and your name. We don't receive your Google password, contacts or files.
• What we store: your name (you can change it), your email address, that Google account number, and when you created the account and last signed in. For each device you sign in on, we store a session: a scrambled (hashed) form of its key, a short device label such as “Chrome on Windows” worked out from your browser's details (the details themselves aren't stored), and when the session started, was last used and expires.
• Why: to sign you in, to show you the devices you are signed in on so you can sign them out, and to keep the account secure.
• Our account service's logs record each request's method and address, never cookies, query strings or your IP address. To stop abuse, it counts requests per IP address in memory for one minute; those counts aren't stored.

Our basis for this: under India's law, your consent, which you give by choosing to sign in and can withdraw by deleting your account; under the GDPR, the agreement in our terms of use (to provide the account you asked for) and our legitimate interest in keeping it secure.

How long we keep data

• A session ends after 30 days without use, or 90 days after you signed in, whichever comes first. Ended sessions are deleted the next time you sign in; ones you sign out are deleted at once.
• Account data is kept until you delete your account.
• When you delete your account, your name and email address are erased and the link to your Google account and every session are deleted, at once. An empty record remains, holding only a random ID and dates, so nothing points to you.
• Backups made by our database host may hold deleted data for a short time, until they are replaced.
• Emails you send us are kept as long as we need them to answer you, then deleted.

What stays in your browser

Some things are kept in your own browser so the site works the way you set it. They stay on your device and are never sent to us: your preferences (theme, layout, favourite tools, and recently used tools only if you turn that on), a yes-or-no note that someone signed in on this browser, the offline copy of the site and its engines, and files shared to the installed app until you choose a tool. The cookie policy lists each one and how to clear it.

Who we share data with

We don't sell or rent personal data, and we don't share it for advertising. It reaches only:

• Our service providers: the company that hosts the website (which receives visits as described above) and the one that hosts the account database (which stores account data for us). They act on our instructions.
• Google, when you choose to sign in. Google handles the sign-in under its own privacy policy and learns that you signed in to Staydoc.
• Authorities, if the law requires it.

These providers may process data outside India or your own country. Where the law requires it for transfers from the EU or UK, we rely on safeguards such as the European Commission's standard contractual clauses.

Your rights

Wherever you live, you can see the account data we hold about you, correct it (you can change your name in your account settings), and delete it (delete your account in its settings, or ask us). Deleting your account also withdraws your consent.

In India, under the Digital Personal Data Protection Act, 2023, you also have the right to a summary of your data and how it is used, to have grievances addressed, and to nominate someone to exercise your rights if you die or can't. If you aren't satisfied with our answer to a grievance, you can complain to the Data Protection Board of India.

In the EU and UK, under the GDPR, you also have the right to restrict or object to how we use your data, to receive it in a portable form, and to complain to your data protection authority.

To use a right, email us at [email protected], from the address on your account if you have one, so we can confirm it's you. We answer within 30 days.

Security

The site is served over HTTPS with a strict security policy. Sign-in cookies can't be read by page scripts, are sent only over HTTPS and only to our account service, and we store session keys only in hashed form. No method is perfect: if a breach ever affects your account data, we will tell you and the authorities as the law requires.

Children

Anyone can use the tools, which hold no personal data. Accounts are for people aged 18 or over. If you are under 18, please don't create one. If you think a child has created an account, tell us and we will delete it.

Changes to this policy

When this policy changes, we update the date at the top. If a change affects how we use account data, we will tell account holders before it takes effect.

Contact and grievances

Questions, requests and grievances about your personal data: [email protected]. This is also the contact for grievances under India's Digital Personal Data Protection Act. More ways to reach us are on the contact page.