Legal
Privacy Policy
What IDOP Cloud and this website keep about you, why, where and for how long.
Last updated:
Working draft. This text describes how the service works today. Before paid services begin it will be reviewed and completed with the operator’s registration details. Questions: legal@idoplabs.com
This policy explains what IDOP Cloud (https://cloud.idoplabs.com) and this website keep about you, why, where, and for how long. The controller of your personal data is IDOP LABS, reachable at privacy@idoplabs.com.
The short version
- You can open and run IDOP documents without an account. Then we keep nothing about you beyond short-lived technical logs.
- With an account we keep what the account needs: your email address, a display name, an optional picture, your language, your folders and files, and the share links you create.
- No advertising, no tracking, no selling of data. There is no behavioural analytics in the product.
- Your API keys stay in your browser unless you explicitly choose to keep a key on your account.
- Deleting your account deletes your data. There is no "soft delete" and no grace period.
What we process, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, password (handled by our authentication provider; we never see it in plain text), display name, language | Creating and securing your account, signing you in, password reset, essential service emails | Contract, Art. 6(1)(b) |
| Name, email address and picture from Google, if you sign in with Google | Signing you in; the picture is copied once to your profile if you have none | Contract, Art. 6(1)(b) |
| Profile picture you upload (resized to 256 px in your browser, which also removes location metadata) | Showing your account | Contract |
| Files and documents you store, their names and folder structure | Providing storage. We do not read, parse or analyse the content of your files on our servers. | Contract |
| Share links: a random token, expiry, an optional password stored only as a one-way hash, the number of times opened | Letting you share, and letting you see how often a link was used | Contract |
| Settings you choose to keep on your account: non-secret environment variables, and — only if you select it for a particular key — an API key | Having your configuration on every device | Contract; your choice |
| Technical logs: IP address, time, requested address, response status | Security, abuse prevention (for example rate limits on share links), fixing errors | Legitimate interest, Art. 6(1)(f) |
What stays on your device
Documents you open from your own disk are processed in your browser and are not uploaded. API keys you enter are kept in your browser (for the tab, the session, or the browser, as you choose) and are added to requests by your browser, to the services you pinned them to. Requests that a document makes with your permission go from your browser directly to that service; they do not pass through our servers.
We use your browser's storage for things the product needs to work: your sign-in session, your preferences, recently opened items. We do not use cookies for tracking or advertising.
AI assistants you connect
You can connect an AI assistant (such as Claude or ChatGPT) to IDOP Cloud. You sign in and approve the connection on our consent screen, and you can withdraw it at any time. A connected assistant can, when you ask it to, list, read, create, change, share and delete files in your account; we read a document only to answer such a request and keep nothing from it. What you and the assistant exchange — including document content we return to it — is handled by the assistant's provider under its own terms and privacy policy.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Accounts, authentication, the database of folders, links and settings | EU (Ireland, AWS eu-west-1) |
| Cloudflare, Inc. | Hosting the application, storing file contents (R2), network protection | Global network; storage location selected by Cloudflare |
| Resend (Plus Five Five, Inc.) | Sending account emails (confirmation, password reset) | EU (Ireland, AWS eu-west-1) |
| Google LLC | Sign-in with Google, only if you use it | Global |
Where a provider processes data outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. When paid plans start, payments will be processed by our payment provider, Stripe; this policy will be updated, with the details, before then.
How long we keep it
- Account data, files, links and settings: until you delete them or your account.
- Expired and revoked share links: removed automatically within about ten minutes.
- When you delete your account: database records are deleted immediately; stored file contents are removed by an automatic process shortly afterwards.
- Technical logs: kept for short periods, at most 30 days.
Your rights
You may access, correct, export and delete your data. Most of this you can do yourself in IDOP Cloud: edit your profile, download your files, and delete your account in Settings → Security. You may also object to processing based on legitimate interest, and ask for restriction. Write to privacy@idoplabs.com; we answer within one month. You have the right to complain to a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl) — or the authority where you live.
Children
IDOP Cloud accounts are for people aged 16 and over.
Changes
We will announce material changes in the product and by email before they take effect.