Privacy policy

Who is responsible

Anthony Pradier is the data controller for the processing described here.

For anything about your personal data, including the requests described below, write to contact@texifine.com.

What is collected, why, and for how long

• Your account — your email address, first and last name, whether you sign in with a Texifine password or through Google or GitHub, the date of your last sign-in, the plan you are on, whether the account has been suspended and since when, whether you agreed to receive product news (with the date and a reference to the exact wording you agreed to), and, for a Texifine password, its bcrypt hash (never the password itself). Purpose: creating and running your account. Legal basis: performance of our contract with you. Kept until you delete your account, and deleted automatically after three years without a sign-in, following a warning email. An account whose email address is never confirmed is deleted automatically after 7 days.
• Your documents — everything you write (text, equations, tables, code listings, the images you upload), the PDFs compiled from them, the page previews, and a record of each compilation, which includes the email address of the account that requested it. Purpose: providing the editor. Legal basis: performance of our contract. A document you delete stays in the bin for 30 days, then it and its files are deleted for good. Everything is deleted with your account.
• Email verification and password reset links — a single-use token, its expiry date and the date it was used. Purpose: confirming your address and letting you set a new password. Legal basis: performance of our contract and our legitimate interest in the security of accounts. Deleted with your account.
• A log of the emails sent to you — the recipient address, the type of email, whether it was delivered, how many attempts it took and when. Purpose: being able to answer "why did I never receive it?". Legal basis: our legitimate interest in a working service. Kept 90 days, and deleted immediately when you delete your account.
• A journal of administrative actions — when an administrator suspends, reactivates or deletes an account, a line records which action, when, which administrator took it, the reason they gave if any, and the account concerned: its internal number and a shortened form of its email address (the first letter and the domain, such as a…@example.org), never the full address. When an administrator sends an email from the administration, the line records its kind, its subject and how many people it was sent to — not who. Purpose: being able to account afterwards for a decision that affects someone's account. Legal basis: our legitimate interest in the accountability of the administration. Kept 12 months. Administrators see how much an account uses Texifine (how many documents, how many compilations), never the contents of a document.
• The waitlist — only if you signed up on the home page: your email address, the profile you selected, and a reference to the exact wording of the consent you gave, with its date. Purpose: telling you when Texifine opens, and being able to prove your consent. Legal basis: your consent. Kept until you unsubscribe or ask for deletion, and at the latest three years after you signed up. Unsubscribing — through the link in an email, or the switch in your settings if you have an account — deletes your sign-up at once.
• Product news — emails about new features and about Texifine opening. They are sent only if you agreed to them: by ticking the box when you created your account, by switching them on in Settings → Account, or by signing up to the waitlist — and only to a verified address. Legal basis: your consent, which you can withdraw at any time, in your settings or through the unsubscribe link in each of these emails; either one stops them for good, whichever way you had agreed. That link identifies your address by a signed code, not by the address itself. Messages about your account itself — verifying your address, resetting your password, a notice about your account or about these terms — are not product news: they are part of running the service (legal basis: performance of our contract and our legitimate interest), are sent whatever this setting says, and carry no unsubscribe link.
• Technical logs — our servers record technical events to keep the service running and to investigate incidents. The application deliberately masks email addresses in its own logs. The web server records IP addresses, as every web server does, to answer requests and detect abuse. Legal basis: our legitimate interest in security and reliability. These logs rotate automatically: the oldest entries are deleted as new ones are written.
• Protection against abuse — to stop mass sign-ups, passwords being guessed by trial and error, and Texifine being used to flood someone else's inbox, the number of recent attempts is counted for each IP address that uses the sign-up, sign-in, password-reset, verification-email or waitlist forms, and for each email address typed into the sign-in, password-reset and verification-email forms. Neither address is kept as such: each is replaced by a keyed fingerprint (HMAC-SHA-256) whose secret key is generated when the server starts, is never written anywhere and disappears at the next restart, so a fingerprint cannot be turned back into the address it came from. These counters exist only in the server's memory — never on disk, in a log or in a backup — and each one is erased at the latest 75 minutes after the last attempt, and at every restart. Legal basis: our legitimate interest in the security of the service and of your account (recital 49 of the GDPR).
• Feedback sent from the editor — only if you use the Feedback button: the kind of remark you picked, the text you wrote, and what is attached to it so that a problem can be reproduced: the type of the block that was selected, the name of your browser and of your operating system (such as "Firefox" and "Windows" — not the full string your browser sends, which names exact versions), the language of the document and the size of your window. Nothing of the document itself is attached: neither its contents, nor its title, nor which document it was. The form says so before you send. Purpose: fixing and improving the editor, and answering you about what you reported. Legal basis: our legitimate interest in a working service. It is linked to your account and read by the administration. Kept until you delete your account, and deleted with it at once; you can also ask for a message to be deleted earlier. To keep the form from being abused, an account can send three messages an hour and ten a day: that count exists only in the server's memory and disappears at the latest a day after the last message, and at every restart.
• Backups — copies of the database, so the service can be restored after an incident. Legal basis: our legitimate interest in the continuity of the service. A backup is kept for at most 30 days, so anything you delete has also disappeared from the backups within 30 days.
• Audience measurement, only if you accept it — which pages are viewed, and a short list of actions: signing up and how, verifying an address, signing in, creating a document or a label, deleting a document, compiling (and whether it succeeded, failed or timed out), downloading a PDF, exporting a document as an archive, inserting a block and its type, inserting a symbol from the library and which one, changing a setting of the Document panel (language, table of contents, abstract, bibliography), switching between the editor's views (blocks, LaTeX source, PDF), opening the editor's help or a block's page of the manual, opening the Feedback form and whether it was sent or refused — with the kind of remark chosen, the length of the message and the time it took, never its text —, the view chosen in the demo of the home page, starting or finishing a video of the manual, joining the waitlist and the profile chosen, and deleting an account. Purpose: understanding what is used and what breaks, so the right thing gets fixed. Legal basis: your consent, which you can withdraw at any time. Kept 12 months.

Audience measurement

Nothing is measured until you have accepted it. A banner asks once, refusing takes exactly one click like accepting, and if your browser sends a "Global Privacy Control" signal it counts as a refusal and the banner is not even shown.

You can change your mind at any time: the Cookie preferences link at the bottom of every page reopens the choice, and signed-in users also find the setting in Settings → Account. Withdrawing your consent is as easy as giving it, and it stops the measurement immediately.

The tool is PostHog, on its European servers, acting as our processor. It is configured for the minimum it can do: no session recording — your documents are never filmed — and no automatic capture of what you click, so only the short list of events above is sent, with no title, no content and no email address.

If you are signed in, events carry your account's numeric identifier so that a first compilation can be connected to the sign-up it came from. That number means nothing outside our database, and your name and address are never sent.

What is never done

• No advertising, no profiling, no automated decision-making.
• No sale, rental or sharing of your data for someone else's marketing.
• No tracking across other websites: the audience measurement described below stops at Texifine.
• Your documents are private unless you make one public. They are not read: access would only happen if you explicitly ask for help with a specific problem, or if the law requires it.

Cookies and local storage

Texifine sets no advertising cookie. Everything below except the audience measurement is strictly necessary to run the service, and needs no consent.

• A cookie that lives for three minutes while you sign in with Google or GitHub, to carry your sign-in request through the redirection. For the same few moments, your browser's session storage keeps a random value that lets only the browser that started the sign-in finish it; it is removed as soon as you are signed in.
• Your browser's local storage, which keeps the token that signs you in, a few editor preferences such as whether compilation is automatic, and your answer to the audience-measurement banner. The preferences and that answer never leave your browser; the token is sent to our API to authenticate your requests.
• If, and only if, you accept audience measurement: what PostHog stores in your browser to recognise a visit across pages. Refuse, and nothing of it is stored or loaded at all.

Who else sees your data

• OVHcloud (France) — hosts the application, the database and your files, as our processor.
• Brevo (France) — sends the emails: address verification, password reset, waitlist, and the service messages and product news written by the administration. It receives your email address and the information shown in the message, as our processor.
• Google or GitHub — only if you choose to sign in with one of them. They confirm your email address and name to us. These companies are established outside the European Union, so signing in this way involves a transfer of your data to a third country. It is entirely your choice: you can create a Texifine account with an email address and a password instead.
• PostHog (European servers) — audience measurement, and only if you accepted it, as our processor.
• Nobody else. No advertising network, no data broker.
• Everything Texifine hosts itself stays in the European Union.

Your rights

Under the GDPR you may ask for access to your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable form, and withdraw a consent you gave — withdrawing it does not affect what was done before.

Five of these you can exercise directly: change your name in Settings → Account, delete your account there too — which removes your documents, their files, their compilations, your labels and the feedback you sent immediately and permanently — switch product news on or off in the same place or through the link in any such email, turn audience measurement on or off from the Cookie preferences link at the bottom of any page, and take a document with you: Export (.zip), in a document's menu in the dashboard or next to the tabs of the editor, downloads an archive holding its LaTeX source, its images, its PDF and the document as Texifine stores it, in an open format (JSON). The archive is built when you ask for it and is not kept on our servers.

For anything else, write to contact@texifine.com. You will get an answer within one month. If there is any doubt about who is asking, proof of identity may be requested.

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

Security

• Traffic to the application is encrypted (HTTPS).
• Passwords are stored as bcrypt hashes and are never readable, by anyone, including us.
• Your documents are private by default; a document becomes readable by others only if you mark it public.
• Documents are compiled inside a disposable, isolated container with no network access, which cannot reach other users' files.
• Sign-up, sign-in and password-reset attempts are limited, so a password cannot be guessed by trial and error and nobody can use Texifine to flood someone else's inbox. The addresses involved are only ever counted as fingerprints that cannot be reversed, and are forgotten within 75 minutes (see above).
• Email addresses are masked in the application's logs, and the logs rotate.
• No system is perfect: if a breach ever affects your data, you will be informed as the GDPR requires.

Age

You must be at least 15 years old to create a Texifine account. Below that age, French law requires a parent's or guardian's consent, which Texifine has no way to collect today.

Changes to this policy

This policy will change as Texifine grows — paid plans, for instance, will add a payment provider and accounting obligations. The date at the top always shows the current version, and any change that matters will be announced by email or in the application before it takes effect.