Privacy Policy

1. HTML conversion and local storage

Files are uploaded temporarily for conversion. Deletion is requested after your browser receives and saves the result; scheduled cleanup removes leftovers. Your workspace and editing drafts remain in the current browser. Supabase holds temporary private objects and session metadata (filename, byte size, ownership, credential hash, keyed network identifier and expiry). These support conversion, access control and abuse prevention. A session normally allows retries for 30 minutes. Upload permissions last two hours; cleanup records outlive those permissions to remove late uploads. Cleanup delays or failures can extend retention; we do not promise deletion at an exact minute.

Your current browser stores original HTML, filenames, conversion results, task metadata, and editing drafts in IndexedDB. Tasks are eligible for deletion seven days after creation and are deleted when the website next runs its cleanup. You can delete tasks or clear local history earlier. Copies you download remain on your device until you delete them.

2. Gallery storage and publication

Gallery submissions are off by default. When enabled, source HTML is stored in a private Cloudflare R2 bucket. Supabase stores title, category, language, account identifier, consent version, file size, content hash, creation time, review status and publication status. Administrator decisions may include a short note and review time. Before approval, submissions are accessible only to their authors and existing administrators. New submissions with gallery-share-v1 consent become publicly previewable on approval, with original HTML downloads and imports into PageOn for signed-in users. Earlier private-review-v1 submissions remain private.

Submission storage is not subject to the temporary conversion cleanup or seven-day browser workspace period. Files remain in private object storage while application access follows their review and publication status. Use My submissions to permanently delete the source file and creation information. Access is revoked first; if storage cleanup fails, the page shows removal pending and lets you retry. We retain an object locator only while cleanup is pending so an operator can finish removal. Download counts record successfully accepted download requests, not confirmed saves on a device. To avoid counting retries twice for seven days, we store the download request identifier, template identifier, account identifier, and request time. Expired records are cleared during later downloads, up to 100 at a time, so deletion is not guaranteed at exactly seven days. Cumulative download totals are retained long term.

Importing a gallery template into PageOn creates a receipt containing an application identifier, template identifier, account identifier, and creation time. Application counts are separate from download counts: an editing task counts once when the editor reports its first successful export. We record its completion time and do not count retries or later exports from that same task again. These minimal receipts and cumulative totals may be retained long term for deduplication, including after source removal; they contain no HTML or filenames and are separate from the seven-day browser workspace cleanup. A minimal approval-reward receipt also retains the submission identifier, 5-Credit amount, and reward time to prevent duplicate grants.

After successful deletion, a minimal account-linked submission identifier and original creation time remain for the rolling 24-hour abuse-prevention quota. These records become eligible for deletion when that quota window expires and are cleared by the next same-account submission or operator cleanup; this is not a guarantee of deletion at an exact time. Service providers may retain backup copies according to their own retention practices. Contact the operator below if removal remains pending or you want account-linked records removed. Your downloaded copies and local workspace are not affected by server removal.

3. Submission privacy checks and review emails

When you choose to submit a template, the PageOn website backend checks extracted text from the file and its title using libraries and rules for contact information, secrets and other supported patterns. Name and organization candidates are limited to explicitly labeled fields; the check does not recognize names or companies throughout ordinary text. It does not alter the file or decide whether it can be published. You can edit first, retry or choose to continue after a warning, partial check or failure.

The scanner does not persist source fragments or reports, and application errors do not include their content. Results remain in the current submission dialog. Images, external resources and script-generated content are not scanned; automatic checks can miss information or flag examples.

Resend delivers a review-request email to the administrator and an approval email to the submitter’s verified account address. Emails contain a submission identifier, relevant links and any confirmed reward, not the HTML or sensitive matches. Minimal delivery status, attempt counts and timestamps are retained to retry failures and prevent duplicate notifications. The email provider processes recipient addresses and message delivery data.

4. Account information

If you sign in with GitHub or Google, authentication is handled through the provider you choose and Supabase. We receive the account information made available by the sign-in flow, such as a user identifier, email address, name, and avatar. We do not receive your provider password. When you register with email, your email and password are submitted directly to Supabase for authentication. Confirmation and password recovery use email; PageOn does not write passwords to local storage, application logs, or analytics events.

Supabase stores authentication information and your Credit entitlement. We use this information to sign you in, show your account, link purchases to you, and prevent unauthorized Credit deductions. You can use local editing and standard exports without an account.

5. Payments and export records

The payment provider shown at checkout, currently Paddle or Dodo Payments, processes checkout and payment information under its own privacy notice. PageOn does not collect or store your full card number or security code. The checkout associates a purchase with your PageOn account identifier.

The application stores the provider name, payment notification and transaction identifiers, account identifier, order and price details, Credits granted, and timestamps to fulfill purchases and prevent duplicate grants. Premium export deduction records contain an export identifier, account identifier, Credits used, and timestamps; they do not contain HTML or filenames and are scheduled for cleanup after seven days.

A separate Credit history records the account identifier, change amount, balance after the change, reason and timestamp from the time this feature is enabled. It does not store HTML, filenames or payment-card details; earlier activity is not backfilled. Credit history is retained with the account and is not deleted by the seven-day export-retry cleanup. The seven-day rule does not apply to account information, Credit balances, or purchase records. These are retained as needed to operate your account, handle payment issues, and meet applicable obligations. Each payment provider maintains its own records and retention practices.

6. Browser preferences and external requests

Browser storage also remembers your sign-in session, language, appearance preferences, and non-sensitive campaign parameters. Signing out removes the local sign-in session; it does not delete your local HTML workspace or your account. Clearing local history does not close your account.

When you start a purchase, the website redirects to the selected provider's checkout or loads its checkout script. Your HTML may also reference external images, fonts, styles, or embedded content. Loading those resources can send your IP address and normal request information to their providers, even when document scripts are disabled in preview.

Hosting and service providers may process technical request information, such as IP addresses, browser information, timestamps, and error details, to deliver and protect the service. We do not intentionally include document bodies in application logs.

7. Analytics and session replay

When analytics is enabled, PageOn uses Baidu Analytics for page views, traffic sources, campaign tags, general device and language categories, and a small set of product events such as upload, editor use, download, sign-in, and checkout. We do not intentionally send filenames, HTML content, email addresses, access tokens, payment details, or full error messages as analytics event properties.

Microsoft Clarity may be used for heatmaps and session replay on public pages such as the homepage and policy pages. It is disabled by default on editor, task, checkout, and administration pages. Account information and user-derived labels are explicitly masked as an additional safeguard. Browser extensions, network policies, or third-party failures may block analytics without affecting PageOn's core features.

8. Providers and processing purposes

We use providers for hosting, GitHub or Google sign-in, Supabase authentication and account data, Cloudflare R2 gallery file storage, Resend review notifications, Paddle or Dodo Payments checkout, Baidu Analytics traffic measurement, and Microsoft Clarity behavior analysis. They receive information needed for their respective services. Processing may occur outside your country, depending on the provider and deployment location.

We process information to provide the service you request, understand and improve product usage, maintain security and reliability, handle support and payment issues, and comply with applicable obligations. Where a separate permission is required, we will seek it. We do not sell your HTML content or use it to train AI models.

9. Your choices and requests

You can download your files, delete local tasks, clear local history, and sign out using the website. Removing browser data also removes local work and preferences, so download anything you want to keep first.

Depending on applicable law, you may request access to, correction of, or deletion of account information, or object to or restrict certain processing. Contact the operator identified below for account and privacy requests. We may verify account ownership before acting, and some records may need to be retained for legal or payment reasons.

We will update this page when our data practices change. The date below identifies the current version.