Privacy policy

The short version

If you use the free converter in your browser, your documents are never sent to us. There is no upload step to opt out of - the conversion runs inside the page, on your own machine, and the file never crosses the network.

If you use the API, your files ARE sent to our server, because that is what an API is. They are converted and discarded in the same request. We do not keep them, and we do not keep what they produced.

What the browser converter does with your files

Nothing leaves the tab. Parsing, optical character recognition, speech recognition and image description all run as WebAssembly inside the page.

The AI model files are downloaded from our servers so your browser can run them. That download tells us a model was fetched; it carries no part of your document, because the document never goes near it.

Your browser stores a few things locally, which never reach us: your sign-in key and its expiry, a count of how many files you have converted this month for the free-tier allowance, and the downloaded models in the browser cache. Clearing site data removes all of it.

What the API does with your files

Files sent to the API are held in memory for the length of the request, converted, and returned to you as JSONL. Nothing is written to disk and nothing is retained afterwards - conversion is stateless, and a stored corpus is a feature we have not built.

We record that a request happened and what it cost: how many files and chunks, bytes received, milliseconds of machine time, bytes returned. That is what a bill is drawn from. It describes the SHAPE of the work, never its content.

What we store about your account

Your decentralised identifier (DID), and your email address where you chose to share one - Google provides it, and a MATA wallet discloses it only if you consent. A plan name. When the account was created.

We use that address only for account and billing mail: a welcome message through Customer.io, plus SES warnings before your balance runs out, a receipt for an automatic payment, and a notice if a payment fails. There is no marketing email and no list to unsubscribe from.

Your prepaid balance: what has been paid in, what has been spent, and a marker for each payment so the same one cannot be applied twice.

Per-month usage totals, as above.

API keys are stored only as BLAKE3 hashes. We cannot show you a key again after it is created, because we do not have it - a copy of our database is not a set of working credentials.

Payments

Payments are handled by Stripe. Card details are entered on Stripe's own hosted page and never reach our servers, which is why we can say we do not store them rather than that we store them carefully.

We keep the Stripe customer identifier so a payment can be matched to an account, and the amount paid. Nothing else about the card.

Who else is involved

Fly.io hosts the API, in London. Your files are processed there and in no other region.

Amazon Web Services hosts this website through Amplify.

Cloudflare provides DNS, and holds backups of the account and billing records described above so they survive the loss of a single provider. Your documents are not in those backups - they are never stored anywhere, so there is nothing of them to back up.

Stripe processes payments.

Amazon Simple Email Service, in the United States, sends account and billing emails. Your email address and nothing about your documents is involved.

Customer.io receives your email address when you create an account, so it can send the welcome message. Nothing else about your account, and nothing you converted, is sent there.

Slack receives a notification when an account is created, when a payment is made, and when someone downloads a free AI model into their browser (OCR, semantic embeddings, or a local vision/speech checkpoint). Sign-up and payment notices contain your account identifier and email address and the amount - never anything you converted. Model-download notices contain no account data.

Google verifies your identity token if you choose to sign in with Google. We send the token Google issued you back to Google to confirm it is real; we receive your email address and nothing further.

Google Analytics records page visits on this site. It does not run on your documents and cannot see them.

How long we keep it

Your files: for the duration of the API request that carried them, and no longer. In the browser tier, we never have them at all.

Account and billing records: while your account exists, and afterwards only where we are required to keep them - payment records generally have to be retained for tax purposes.

Server logs, which record request identifiers and timings but not content, are kept for a short operational period and then rotated away.

Emails we have sent you, and the sign-up and payment notifications described above, persist in those services until we or they remove them.

Backups of account and billing records are copied to Cloudflare R2. The current copy is kept in step with the live system, and dated copies are deleted automatically after 30 days.

Your rights

Under UK and EU data protection law you can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to how it is used. Because we hold very little, most of these are quick to answer.

Deleting an account removes the tenant record, its API keys and its balance. Payment records held for tax purposes survive, because we are not permitted to remove those on request.

Deletion takes effect on the live system immediately. Dated backups made before the deletion still contain the record until they expire, within 30 days - a backup that reproduced every deletion the moment it happened would not be a backup.

Changes

If what the software does changes, this page changes in the same release. It is written from the code rather than around it, so it cannot quietly fall out of date while the product moves.

Contact

Questions about this policy, or a request about your data, go to privacy@ragconverter.com.