Privacy Policy
Last updated November 3, 2026
This policy explains what Plain Text API ("we", "us", "the Service") collects when you use our website, customer portal and API, why we collect it, who we share it with, and the choices you have. The Service is operated by Code There ("Code There"), a company based in Ontario, Canada. If anything here is unclear, write to [email protected].
1. The short version
- Documents are processed at runtime only. Files, text and URLs you send for extraction or conversion are handled in memory while your request runs and are not kept once the response is returned.
- We store output only when you ask us to. That happens in two cases: when you request a webhook or queued job (the result is held briefly so it can be delivered and fetched), and when you request a hosted download link. Both are deleted automatically. Details are in sections 4 and 5.
- We do not read your documents, sell your data, or use your content to train machine learning models.
- We keep account details, billing records and usage statistics (counts and sizes, not content) so we can run and bill the Service.
- Request log, kept 30 days. We keep a log of your recent requests (time, type, result, size, a short error message) for 30 days only, for your own debugging and review and for our support. It never contains your documents or the text we return. For a URL request it shows the address you sent, without anything after a question mark. You can view it on the Requests page of the customer portal and delete it whenever you like.
- You can download your data and delete your account yourself, at any time, from the Security page of the customer portal.
2. Information we collect
Account information
Name, email address, a hashed password, your plan, and the API keys we issue to you. API keys are stored as a one-way hash for authentication and an encrypted copy so you can reveal them from your dashboard.
Billing information
Payments are handled by Stripe. We never see or store your full card number. We receive and keep a customer ID, subscription status, plan, invoices and the last four digits and brand of your card as reported by Stripe.
Usage and technical data
For each API request we record which key made it, the date, the source or conversion type (for example "pdf" or "docx to pdf"), the input size, the output length, how long it took and whether it succeeded. We also keep short-lived rate-limit counters and standard web server logs that include IP address, user agent, and the request line with its URL and query string. Request and response bodies are never logged. Because query strings are logged, do not put secrets in URL parameters.
Website data
We use only essential cookies: a session cookie that keeps you signed in to the customer portal and a security token that protects forms. We also store a small preference value in your browser (local storage) to remember your light or dark theme. We do not use analytics, advertising cookies or third-party trackers on our own pages, so there is no cookie banner. Our payment provider sets its own cookies on its hosted checkout pages.
3. Your documents and links (content you send us)
"Your Content" means files, text, HTML, URLs and any other data you submit through the API or portal, and the results we produce from it.
- Synchronous requests. Your Content is held in memory only for as long as needed to produce the result and is discarded when the response has been sent. It is not written to our database or permanent storage and is not included in backups.
- URL requests. When you give us a URL, our servers fetch that page on your behalf. You are responsible for making sure you may fetch and process it. We block requests to private and internal network addresses.
- Temporary processing files. Some conversions (for example Word to PDF, or PDF to images) run through helper programs that need temporary files on disk. These are placed in a private temporary folder and deleted as soon as the conversion ends, whether it succeeds or fails.
- In transit. Traffic to our API and website passes through Cloudflare, which terminates the secure connection and forwards the request to our server. We do not cache API responses. Cloudflare handles that traffic as our service provider.
- No human review. We do not open or review Your Content as part of normal operation. We may access specific content only if you ask us for support, or where we are legally required to or must investigate a report of abuse or infringement (section 9).
4. Hosted file links and cloud storage
On plans that include it, you can ask for a link to the output file. In that case we upload the result to Cloudflare R2 object storage and return a URL.
- Files are kept for a limited period, set by us (by default 24 hours, and never more than 30 days), and are then deleted automatically, usually within minutes of expiry. A small record of the file (size, type, times) is kept for a further 30 days and then removed. It is not linked to you once your account is deleted.
- Links are either signed (they stop working after a set time) or public, depending on how the Service is configured. Anyone who has a link can open the file until it expires. Do not share links to confidential material, and do not use hosted links for highly sensitive data unless you accept that risk.
- Hosted files are stored with Cloudflare R2, which, according to its provider, encrypts data at rest and in transit. Hosted files are not part of our backups.
- We may remove any hosted file at any time, for example in response to a legal notice or a suspected breach of our Terms.
5. Queued jobs and webhooks
If you submit a job with a webhook URL, we process it in the background and then send the result to the URL you provided. We keep the job record and result in our database for up to 24 hours so you can fetch it with the jobs endpoint, then clear the result. If your plan has no hosted links and the result is a converted file of up to 8 MB, the file is stored inside the result (encoded) for that same period. The job record itself (id, type, status, delivery status and attempts, but no content) is kept for a further 30 days and then deleted. You choose the destination of a webhook, so you are responsible for that endpoint's security and for what it does with the data. Requests are signed with a secret so you can verify they came from us.
6. How we use information
- To provide, secure and improve the Service, including enforcing plan limits and preventing abuse.
- To bill you, send receipts and manage your subscription.
- To send service emails such as address verification, password resets and plan or billing notices. We do not send marketing email unless you opt in.
- To respond to support requests, legal requests and reports of infringement or abuse.
- To meet legal, tax and accounting obligations.
7. Who we share information with
We share information only with service providers that help us run the Service, under contracts that limit their use of it:
- Stripe for payment processing.
- Cloudflare for DNS, network protection and content delivery, and for R2 file storage when you use hosted links.
- An email delivery service to send our service emails (sign-up confirmation, password reset, sign-in codes, plan notices).
Our application runs on our own server infrastructure in Canada. Providers may handle your data in the countries where they operate.
We may disclose information if the law requires it, to enforce our Terms, or to protect the rights, property or safety of our users, the public or us. If the business is sold or merged, information may transfer to the new owner under the same commitments. We do not sell personal information and we do not share it for cross-context behavioural advertising.
8. International transfers
We are based in Canada and our servers are in Canada. Cloudflare, Stripe and our email delivery provider are global services and may process data in Canada, the United States and other countries. Where required, we rely on appropriate safeguards for those transfers, such as the providers' standard contractual clauses.
9. Copyright and content reports
We act on credible reports that content processed or hosted through the Service infringes copyright or other rights. See our Terms of Use for the notice procedure. When we act on a report we may need to access or disclose the relevant hosted file, its metadata and the account details of the person responsible.
10. Retention
| Data | How long |
|---|---|
| Documents sent for synchronous processing | Not retained; discarded when the response is sent |
| Temporary processing files | Deleted when the conversion ends |
| Hosted output files | Until the retention period ends (default 24 hours, maximum 30 days) |
| Queued job results | Up to 24 hours; the job record without content for 30 more days |
| Request log (time, type, result, size, short error message, and for URL requests the address without its query string; no document or output content) | 30 days, then deleted automatically; you can delete it yourself at any time on the Requests page |
| Usage statistics (counts, sizes, timing) | While your account exists; deleted with it |
| Web server logs (IP, user agent, request URL) | About 14 days; security block lists and related logs up to 4 weeks |
| Application error logs | About 14 days |
| Sign-in sessions | 2 hours of inactivity |
| Sign-in codes and password reset links | Minutes to hours; each is single use |
| Billing and tax records (held by Stripe and us) | As required by law, typically 7 years |
| Account details | Until you delete your account |
| Database backups | Nightly; copies are removed as backups roll off, generally within 7 days |
When you delete your account, your data is removed from our live systems promptly, except billing records we must keep. Copies in backups are removed as the backups roll off, generally within 7 days. We do not restore deleted accounts from backups except to recover from a system failure.
11. Security
We use reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS), hashed passwords and API keys, encrypted storage of secrets, optional two-factor sign-in (authenticator app or email code), network-level protection, limited access to our servers, and isolation of conversion processes. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information we will notify you and the relevant authorities as the law requires.
12. Your rights
Depending on where you live (including under Canada's PIPEDA and Quebec's Law 25, the EU and UK GDPR, and US state laws such as the CCPA), you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can do the most common things yourself in the customer portal: change account details, download a copy of your data, delete your request log (Requests page) and delete your account (Security page). For anything else, or to make a complaint, email [email protected]. We will respond within the time the law allows. You may also contact your local data protection authority.
13. Your content and personal data of others
If Your Content contains personal information about other people, you are the controller (or responsible organisation) for it and we act as your service provider (processor). You must have a lawful basis to send it to us. If you need a data processing agreement, contact us.
14. Children
The Service is for businesses and developers and is not directed to children. You must be at least the age of majority where you live to create an account. If we learn that we hold a child's personal information we will delete it.
15. Changes
We may update this policy. When the changes are significant we will notify account holders by email or in the portal before they take effect. The date at the top of this page shows when it was last updated.
16. Third-party names
Product, file format and company names mentioned on our site and in our documentation (for example Microsoft Word, Excel and PowerPoint, Adobe PDF, OpenDocument, Stripe and Cloudflare) are trademarks of their respective owners. We use them only to describe compatibility and the services we rely on. We are not affiliated with, endorsed by or sponsored by those owners.
17. Contact
Code There, Ontario, Canada. Email: [email protected].