Privacy and cookie policy
We collect what we need to run the service and nothing else. No ads, no data sales, no tracking analytics. Your render history is deleted automatically after 30 days by default, or 7 or 90 days if you choose.
Format is a platform for building and generating PDFs with web technology run by FORMAT.DEV LTD, a company registered in England and Wales (company number 17456536, registered office 111 Ryhall Road, Stamford PE9 1UJ). We are the data controller for the personal data described here.
This policy covers the Format website, documentation, dashboard, APIs, and developer tools. It also covers cookies, so there is no separate cookie notice.
What we collect
Account data
You sign in with Google or GitHub. We never see your password for either.
When you sign in, we create your account from the profile the provider shares with us. We use it to identify you, sign you in, and show your name and picture in the dashboard. We also use your email address to send transactional notifications about your account and organizations.
We also record the IP address and browser user agent of each sign-in session. We use them to keep your account secure.
Signing in with Google or GitHub
When you choose Google or GitHub, we ask for your basic profile only. The provider shows you what it will share before you agree.
| GitHub | ||
|---|---|---|
| Permissions we request | openid, email, profile | read:user, user:email |
| What we receive | Account ID, name, email address and whether it's verified, profile picture | Account ID, name, email address, avatar |
| What we can't access | Gmail, Drive, Calendar, contacts, or any other Google data | Your repositories, code, or any other GitHub data |
| Remove access | Google account permissions | GitHub authorized apps |
We use this data only to create your account, sign you in, and contact you about the service. We store it in our own database with the rest of your account data.
At sign-in, the provider also gives us tokens that confirm who you are. We use them only to complete sign-in and get the basic profile described above. For GitHub, that means reading your profile and email addresses as you sign in. We store the tokens with your account record and don't use them after sign-in.
We don't sell this data or pass it to data brokers. We don't use it for advertising, to assess creditworthiness or for lending, or to train AI or machine learning models. We only share it with the service providers listed below, and only as far as they need it to run Format.
Our team reads this data only when you ask us to, when we need to for security, such as investigating abuse, or when the law requires it.
Format's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Removing Format's access disconnects Format from your Google or GitHub account. It doesn't delete your Format account or its data, and you can reconnect by signing in again. To delete your data, delete your account from the dashboard.
Signing in to Studio
Studio signs in through the dashboard. Each Studio sign-in creates a session record with your device name. The token Studio uses to stay signed in stays on your computer. We store only a one-way hash of it, which can't be used to recover the token.
Documents you build and render
Any code you write in Studio or an SDK stay on your local computer while you build them. Studio contacts our servers to sign you in and to download the rendering engine. It does not report what you are building or send us any of your local code.
When you generate a PDF, the HTML, CSS and assets for that document will be sent to our servers.
We keep a history of your renders, including the HTML, so you can review recent activity in your dashboard. Render history is kept for 30 days by default. You can change this to 7, 30, or 90 days in your organization settings. After that, it is deleted automatically.
Treat this for what it is: your documents may contain personal data about your own users. For that data, you are the controller and we are your processor. We only process it to render and deliver your documents.
Logs and request data
Like every web service, we log requests. Logs include your IP address, user agent, and request metadata. We use them to keep the service running, debug problems, and prevent abuse.
Visits to our marketing site and docs pass through Cloudflare, which gives us edge data such as IP address, approximate location, and user agent.
Newsletter and feedback
If you join our mailing list, we store your email address to send you updates. Every email includes an unsubscribe link.
If you send feedback through the docs, we store your rating, your message, and your email address if you choose to give it.
What we don't collect
We currently run no analytics or tracking on any of our sites. If we add analytics later, we will use a privacy-focused tool that sets no cookies and does not track you across sites. We will name it here when we do.
We never sell personal data, and we never share it with advertisers.
How we use your data
We use your data to:
- Provide the service: sign you in to the developer tools, render documents, operate your account, and show your render history
- Communicate with you: transactional notifications about your account and organizations, plus the newsletter if you opted in
- Keep the service safe: debug failures, enforce rate limits, and prevent abuse
- Meet legal obligations
Our legal bases under UK GDPR are performance of a contract, legitimate interests, consent, and legal obligation. The contract basis covers running the service you signed up for. Legitimate interests cover security, debugging, and service improvement. Consent covers the newsletter.
How long we keep it
| Data | Retention |
|---|---|
| Render history, including document content | 30 days by default, configurable to 7, 30, or 90 days, then deleted automatically |
| Account data, including your Google or GitHub profile and sign-in tokens | While your account exists. Deleted when you delete your account, usually within minutes |
| Dashboard sessions | 30 days, renewed periodically while you use the service |
| Studio sessions | 30 days, renewed while you use Studio |
| Server backups | Seven days, then replaced by newer backups |
| Server logs | Up to 90 days |
| Newsletter email | Until you unsubscribe |
| Feedback | Up to two years |
You can delete your account and its data at any time from the dashboard. Deleting your account signs you out everywhere, then removes your sign-in data, memberships, personal organization, and render history. Copies in our server backups expire within seven days.
Who we share it with
We use a small number of service providers to run Format. Each one only receives the data it needs:
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare | Hosts our website and docs | Visitor IPs, location, user agent |
| Hetzner | Hosts our servers, database, and backups | Everything stored in our database |
| Unikraft Cloud | Runs our rendering infrastructure | Document content during rendering |
| Resend | Sends transactional email | Email addresses and message content |
| Sign-in | Google account identity | |
| GitHub | Sign-in and infrastructure | GitHub account identity |
Newsletter signups and docs feedback are handled by our email and feedback tooling. Email [email protected] for the current list of providers.
We run our own databases and file storage on servers we rent from Hetzner. We may also disclose data where the law requires it.
If Format is involved in a merger or acquisition, we'll ask for your consent before transferring your Google account data.
The Format CLI checks the npm registry for updates. That request comes from your machine, not ours, and sends npm your IP address like any package install does.
How we protect your data
We protect your account data, including your Google or GitHub profile and sign-in tokens, like this:
- All traffic between you and Format is encrypted with HTTPS.
- Your dashboard session lives in a secure, HTTP-only cookie that scripts on the page can't read.
- Studio's sign-in token stays on your computer. We store only a one-way hash of it.
- Your sign-in tokens are readable only by our backend, and by you while you're signed in.
- Access to our production database is limited to Format staff who need it to run the service, and requires an admin key.
Where your data lives
Our servers are in the UK and EU. Some providers, such as Google, GitHub, and Resend, may process data in the US. Where data leaves the UK, we rely on adequacy decisions or standard contractual clauses.
Your rights
Under UK GDPR you can ask us to access, correct, delete, or export your personal data. You can also object to the processing we base on legitimate interests, which for us means security, debugging, and service improvement.
You can delete your account yourself from the dashboard. We handle other requests by hand. Some processing can't be separated from running the service, so if you object to that, the practical answer is closing your account. We'll tell you which applies to your request.
Email [email protected] and we will respond within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.
Cookies
We set cookies for one purpose: keeping you signed in to the dashboard. These are essential cookies, so there is no consent banner to click through.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookies | Keep you signed in | 30 days, renewed periodically while you use the service |
The marketing site and docs set no cookies at all. If we add privacy-focused analytics later, it will be a cookieless tool, and this section will say so.
Children
Format is a business tool. It is not for anyone under 18, and we do not knowingly collect data from children.
Changes
We update this policy when the service changes. For significant changes we will tell account holders by email. The date at the top always shows the latest version.
If we want to use your Google account data for a new purpose, we'll explain the change and ask for your consent first.
Contact
Questions about privacy: [email protected].