Privacy policy

• We collect the least we can: an email address to have an account at all, and the documents you choose to upload.
• Reader analytics on published sites use no cookies and store no IP addresses.
• We do not sell personal data, and we do not run advertising or third-party trackers.
• Payment happens at Paddle. We never see your card details.
• You can export everything and delete your account yourself, at any time.

Questions, or a request about your data: hello@docszero.com. A person answers.

Docszero is run by Yeakin Iqra, an independent developer, who is the data controller for everything described in this policy. There is no company behind it and no team with standing access to your data. Contact: hello@docszero.com.

For the documentation you publish, the position is different. You are the controller of your own readers' data and of anything personal inside your documents; we process it on your instructions as part of running the service.

When you create an account

• Your email address, which we verify before you can sign in.
• A password, stored only as a salted hash. We cannot read it.
• An optional company or team name, if you give one.
• The plan you are on, and the timestamps for when the account and the email were confirmed.

When you use the product

• The documents, images and other files you upload or write in the editor, and their version history.
• Project settings: site name, description, author line, language, navigation order.
• Build records: when a build ran, how long it took, whether it succeeded, and its log.
• Ordinary server logs, which include IP addresses, for security and debugging.

When you pay

Paddle takes the payment and holds the card details. We receive a customer and subscription identifier, the plan, the interval, the seat count, the status and the period end date. We never receive or store card numbers.

When someone reads your published site

This is the part people usually expect to be worse than it is, so here is exactly what happens on a page view.

• We record the path, the referring host, and a country code when a CDN gives us one.
• We record a visitor value that is a one-way hash of a secret, the date, the IP address and the user agent, truncated to 32 characters. The IP address itself is never written down.
• Because the date is part of the hash, the value changes every day. It cannot be used to follow someone across days or across sites.
• Only successful HTML page views from non-bot user agents are counted. Pages behind a password are not counted until the password has been entered.
• No cookie is set for analytics, so there is nothing to consent to and no banner to dismiss.

Docszero sets three cookies, all of them necessary for something to work. There are no advertising or analytics cookies, on this site or on the sites we publish.

These are every third party that touches personal data on our behalf. We do not sell personal data, and we do not share it for advertising.

Where data leaves the UK or EEA, transfers rely on the relevant standard contractual clauses or an adequacy decision. Paddle's own handling of payment data is covered by Paddle's privacy notice.

We will also disclose data if the law requires it. Where we are permitted to tell you first, we will.

Deleting a project removes its files and its published site. Deleting an account removes its projects too. Both are immediate, and neither is reversible on request.

Depending on where you live you may have the right to see what we hold, correct it, delete it, get a copy in a portable form, object to processing based on legitimate interests, or withdraw consent.

• Most of these you can exercise yourself: Settings shows and edits your account, export gives you a portable copy of your content, and account deletion is a button.
• For anything else, write to hello@docszero.com. We answer within 30 days.
• You can unsubscribe from product notes with the link in any of them. You cannot unsubscribe from transactional email while you have an account, because it is how we tell you a build failed or a payment did not go through.
• If you are unhappy with how we handled a request you can complain to your local data protection authority.

We never ask for your password by email, and we never ask for card details. Neither will Paddle.

• Everything travels over HTTPS, on this site, in the app, and on every published site.
• Passwords are stored as salted hashes, never in a readable form.
• Session and CSRF cookies are marked Secure and SameSite=Lax; the session cookie is also HttpOnly.
• Pages behind a password are served with no-store, so no CDN keeps a copy.
• Access to production data is limited to the people who need it to run the service.

No system is perfect. If you find a vulnerability, please write to hello@docszero.com before disclosing it publicly, and we will work with you on a fix.

We will post any new version on this page and update the date at the top. If a change materially affects how we use personal data, we will email account holders before it takes effect.