Privacy policy
Last updated
This policy describes what this website and the Pagewright app collect, in plain language. In force from 23 October 2026. Changes are posted here with a new date.
Who we are
The data controller for this website is Business legal name — to be provided by the owner, Postal address — to be provided by the owner. Privacy questions: Privacy contact email — to be provided by the owner.
The Pagewright app
The desktop app opens, edits and saves documents on your computer. It does not upload your documents, has no analytics or telemetry, does not send crash reports and needs no account. To activate or deactivate your licence it sends this website your licence key, a one-way hash of Windows' machine identifier (not the identifier itself), the computer's name and the app version — never documents or file names. After activation it checks the licence on your computer only.
Apart from activation and deactivation, the app connects to the internet only for optional features you start yourself: downloading an OCR language file (from the address shown before you confirm), adding a time stamp to a certificate signature (to the server you enter; only a hash is sent, never the document) and checking for updates (off by default).
What this website collects, and why
| Data | When | Why | Kept for |
|---|---|---|---|
| Order record: order reference, status, price, tax and currency, the payment provider's order and checkout IDs, your email address, name and country as given at checkout, your licence ID | When you buy | To deliver the software, issue your licence, let you recover your download and handle refunds | 7 years after the purchase (tax and accounting records), then deleted |
A browser cookie named pw_order (a random order reference and secret) | When you click Buy | To show your order status and download page when you return from checkout. It is strictly necessary for the purchase you asked for; it is not used for tracking | 30 days |
| Download links (stored only as one-way hashes) and how often they were used | After payment | To limit each link to your order and stop links being shared widely | Until they expire (7 days), then deleted |
| Support messages: your name, email, optional order reference and message | When you contact us | To answer you | 2 years after our last reply, then deleted |
| Your licence key (stored encrypted, so your account can show it again) and licence ID | After payment | To activate Pagewright and let you find your key again | For as long as your licence exists (it never expires); deleted if you ask us to delete your licence |
| Activations: the one-way device ID, computer name, app version, dates, and a one-way hash of the secret that lets that PC deactivate | When you activate or deactivate | To keep each key active on one PC at a time and show your activated PC in your account | For as long as your licence exists; a released or deactivated PC is kept for 90 days (to handle support questions), then deleted |
| Account (optional): your email address, a one-way hash of your password (scrypt), when you created it and last signed in | When you create an account | To let you sign in to see your keys, downloads and activated PC | Until you ask us to delete it |
A browser cookie named pw_session (a random sign-in secret; we store only a one-way hash) | When you sign in | To keep you signed in. It is strictly necessary for the account you asked for; it is not used for tracking | 30 days, or until you sign out |
| Set-password links (stored only as one-way hashes) | When you ask for one | To let you create your account or reset your password | Up to 7 days after they expire, then deleted |
| Rate-limit counters keyed by a one-way hash of your IP address, email address or account | When you use checkout, sign-in, activation, recovery or the contact form | To protect the service from abuse | Up to 24 hours |
| Payment notifications from the payment provider (event IDs, types and a fingerprint of the content) | When the provider tells us about a payment or refund | To process payments reliably and only once | 7 years (tax and accounting records), then deleted |
We do not use advertising or analytics cookies. If analytics are switched on in future, they will be first-party and cookieless, count only page and button events, and never receive order references, email addresses, licence keys or download links.
Payment
Payments are processed by Stripe. You enter your card or other payment details on its checkout page, not on this website; it uses them to take the payment, send your receipt and prevent fraud, under its own privacy policy (stripe.com/privacy). It tells us your email address, name and country and whether the payment succeeded, so we can deliver your order. This website never receives or stores your card details.
We send you a delivery email with your licence key and download link and, if you ask, a new download link or a link to set your password, and a notice when your password changes. Emails are sent through GoDaddy (our mailbox provider). We do not send marketing email.
Sharing
We share personal data only with the service providers above (payment provider, email delivery and Render (hosting, in the United States)), as needed to deliver your order, or when the law requires it. We do not sell personal data.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, or object to its use. Contact Privacy contact email — to be provided by the owner. Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (orders, licences, activations, accounts and support); our legitimate interest in running a secure, reliable service (rate limits, payment notifications, fraud and dispute records); and legal obligations (tax and accounting records). We are based in the United States, and our providers (Stripe, Render and GoDaddy) process data there: for data from the EU, the UK or Switzerland this relies on safeguards such as the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework where a provider takes part in it. You can complain to the data-protection authority where you live; we'd welcome the chance to resolve your concern first. California residents: we do not sell or share personal data, and you can exercise the rights above by email.
Changes
We will post any changes here with a new date.