Privacy statement

This statement explains how Docsheaf (“we”, “us”) handles personal data when you use the Docsheaf app, our API, docs sites published with Docsheaf, and this website. Questions? Email [email protected].

Information we collect

Your account

• Your name, email address and, if you add one, a profile picture.
• Your password, if you set one, stored only as a one-way hash. We can’t read it.
• If you sign in with GitHub or Google: the account ID, name and verified email addresses the provider shares with us, and for GitHub your username. We never receive your GitHub or Google password, we don’t import your profile picture, and we don’t access your repositories, files or other data there.
• If you turn on two-factor authentication, the secret for your authenticator app (stored encrypted) and your recovery codes (stored as hashes).
• API tokens you create, stored as hashes. We show a token once, when you create it.

Your content

The organizations, docs sites, spaces, pages, revisions, change requests, reviews and comments you create, and the files you upload such as images and avatars. Files are stored on our servers’ disks or in an S3-compatible object store (Amazon S3 or Cloudflare R2), depending on how the service is deployed.

Billing

Paid plans are sold through Paddle, our reseller and Merchant of Record (see “Who we share it with”). We never see or store card numbers or other payment details. For each organization with a subscription we keep the plan and billing interval, the number of sites and members billed, the subscription’s status and renewal date, and Paddle’s customer and subscription IDs. We also keep a copy of each billing notification Paddle sends us, which can include billing contact details, so each one is applied exactly once and billing problems can be traced.

Security and activity records

• Sessions: for each signed-in device, its IP address, browser user agent and when it was last active. You can see and sign out these sessions in your account settings. We use them to send alerts when you sign in from a new device.
• Security log and audit log: sign-ins, password and two-factor changes, connected GitHub or Google accounts, and changes to organizations, members, sites and content — with who made them, when, and from which IP address and user agent. Your personal security log is visible to you; an organization’s audit log is visible to its admins.
• Sign-in protection: a count of recent failed sign-in attempts, used to lock an account temporarily after repeated failures.
• Pending sign-ups: while you confirm your email during sign-up, we keep your email, name, password hash and a hash of the code we sent you. Your account is only created once the code is confirmed.

Email

We send transactional email — verification codes, password resets, security alerts and invitations — through an SMTP email provider. We keep a record of each email we send (recipient, type, subject and delivery status) to troubleshoot delivery. We don’t send marketing email unless you ask for it, for example by subscribing to our newsletter.

Readers of published docs sites

When someone reads a docs site published with Docsheaf, we record analytics for the site’s owner. We collect this on the owner’s behalf, and they decide what to do with it.

• Page views: the page path, the referring page and an anonymous visitor identifier. The identifier is a one-way hash of the date, the site, the IP address and the browser user agent. We never store the IP address itself, and because the date is part of the hash, the identifier changes every day and differs between sites — it can count unique visitors but can’t follow a person over time or across sites.
• Searches: the search text and how many results it returned.
• Feedback: the answer to “Was this helpful?” and any comment the reader chooses to add.

Reader analytics use no cookies and no third-party analytics services.

Cookies and local storage

We only use cookies and browser storage that the service needs to work:

The app also uses your browser’s session storage to remember that you dismissed the email-verification reminder. Fonts are served from our own servers, so loading a page doesn’t contact a font provider.

When you open the checkout to buy or change a paid plan, the page loads Paddle’s checkout from paddle.com. Paddle may set its own cookies to run the checkout and prevent fraud; they are covered by Paddle’s privacy policy. Signing in with GitHub or Google takes you to their site, where their own cookies and privacy policies apply.

How we use information

• To provide Docsheaf: sign you in, store and publish your content, and run search and analytics for your sites.
• To keep accounts secure: two-factor authentication, sign-in lockout, new-device alerts, session management and audit logs.
• To bill paid plans: keep each organization’s plan and limits in step with its subscription.
• To send the emails described above.
• To troubleshoot problems and to respond when you contact us.

We don’t sell personal data and we don’t use it for advertising.

Who we share it with

We share data only with service providers that help us run Docsheaf, and only as much as they need. Our list of sub-processors names them:

• Hosting and database providers that run the service.
• Object storage providers (such as Amazon S3 or Cloudflare R2) that hold uploaded files.
• An email delivery provider that sends our transactional email.
• Paddle, our reseller and Merchant of Record, which sells paid plans, takes the payment, handles sales tax and VAT, and sends invoices. It receives the billing details you enter at checkout, plus your email address and your organization’s identifier from us, and handles them under its own privacy policy.
• Anthropic, which writes the answers of the AI Assistant on docs sites that turn it on. It receives the reader’s questions and excerpts of the site’s published pages. We store questions and answers for the site’s owners without the reader’s IP address.

If you choose to sign in with GitHub or Google, that provider knows you signed in to Docsheaf, under its own privacy policy. It doesn’t act for us otherwise.

Organizations that need a data processing agreement can use our DPA.

Content you publish on a public docs site is visible to anyone. Content on an unlisted site is visible to anyone who has its share link. We may disclose information if the law requires it.

How long we keep it

• Account data and content: for as long as your account or organization exists.
• Security logs and audit logs: deleted automatically after a retention period, 365 days by default.
• Sessions: until they expire or you sign them out.
• Unconfirmed sign-ups: deleted within a day of expiring (codes expire after 10 minutes, sign-ups after an hour).
• Docs site analytics: for as long as the site exists; deleting a site deletes its analytics.
• Billing: an organization’s subscription details for as long as the organization exists. Copies of Paddle’s billing notifications are kept as billing records, also after the organization is deleted.
• GitHub or Google connections: until you disconnect them or delete your account.

Your choices and rights

• Access and correction: update your name, email, picture and password in your account settings at any time.
• Export: every page is available as Markdown, and everything in your workspace is available through the REST API.
• Deletion: delete your account yourself in your account settings — your profile, sessions, API tokens, security log, avatar, newsletter sign-up and email history go with it, and organizations you’re the only member of are deleted too. Comments and reviews you left in other organizations stay, without your name. Organization admins can delete the whole organization from its settings. Need help? Email [email protected].
• Sessions: review and sign out other devices from your account settings.
• Connected accounts: connect or disconnect GitHub and Google in your account settings.

Depending on where you live, you may have further rights, such as to object to processing or to complain to a data protection authority. Contact us and we’ll help.

If you are a reader of a docs site published with Docsheaf, the site’s owner decides how its analytics are used. Contact them, or us, with questions.

Security

We protect data with hashed passwords, tokens and codes, encrypted two-factor secrets, HTTP-only session cookies, origin checks on requests that change data, and role-based access control. Read more on our security page, and report vulnerabilities to [email protected].

Children

Docsheaf is not directed at children under 16, and we don’t knowingly collect their personal data.

Changes

We’ll update this statement as Docsheaf changes, and change the date at the top when we do. For significant changes, we’ll let account holders know by email.

Contact

Email [email protected] with any privacy question or request.