Privacy Policy
We collect what it takes to publish a document, show it to people and carry their feedback back to you: your account, the documents you publish, the comments, edits and images people post on them, and the ordinary server logs any website keeps. There is no advertising, no analytics tracker, and we do not sell or rent data to anyone. Anything you post on a document is visible to the people who can see that document, and to the person who published it.
- 1. Who is responsible
- 2. What we collect
- 3. Images in comments
- 4. How we use it
- 5. Who can see it
- 6. Service providers
- 7. Cookies and browser storage
- 8. How long we keep it
- 9. Your rights
- 10. Security
- 11. Children
- 12. Changes
- 13. Contact
1. Who is responsible
The service is operated by Onlay Ltd, a company registered in Scotland ("we", "us"), which is the data controller for the personal data described here under the UK General Data Protection Regulation and the Data Protection Act 2018. Contact: hello@onlay.io.
This policy covers the website at onlay.io, the dashboard at app.onlay.io, the onlay command-line tool, and every document served from onlaycontent.com or a custom domain together with the commenting and editing software we inject into it. It applies to you whether you have an account or are simply reading or commenting on a document someone sent you.
2. What we collect
If you create an account
Sign-up and sign-in are handled by Clerk. Depending on how you sign in, Clerk holds your email address, your name, a profile picture and the identifier of the provider you used, such as Google or GitHub, along with the security records that go with an account: sign-in times, devices and IP addresses. In our own database we keep only your Clerk user id and your account tier. We do not copy your email or name out of Clerk.
When you create an API key in the dashboard we store a hash of it, the name you gave it and when it was last used. We cannot read the key back.
If you subscribe to Pro
Payments are processed by Stripe, through Clerk's billing. Stripe collects your card details and the billing details it needs to take payment, such as your name, email address and country. Clerk keeps your plan, billing period and payment status. We never see or store your card number, and in our own database we keep only which plan you are on.
If you publish a document
We store the document itself, each version you push, the Markdown source if you published Markdown, the sharing settings you chose and the account that pushed it. The document is stored under a random label that becomes its web address.
If you comment on or edit a document
Comments are stored with their text, the passage they point at, the time, and who posted them. For an account holder that is your Clerk user id. For a visitor without an account it is a random per-document visitor id, plus the name and email address the runtime asks for before your first comment. The name is shown next to your comment. The email address is stored with the comment and is not shown to other readers or handed back to the document's author. We do not verify it. We may use it in future to let you know when someone replies, and we will update this policy before we do.
Edits are stored as a history: the text before and after each change, who made it and when. On collaborative documents we also keep short-lived presence records, meaning your display name and the paragraph you are working in, so that other people see where you are. We also record which comments you have seen, so the interface can show what is unread.
Everyone
Like any web service we receive standard request data whenever your browser or the CLI talks to us: IP address, browser or client version, the address requested, and timestamps. This goes into short-lived operational logs kept by our hosting providers for reliability, debugging and abuse prevention. The CLI sends nothing beyond the request it is making and its own version number; it has no telemetry.
We do not run advertising. On onlay.io we count page views with PostHog, without a cookie and without a profile: see section 7. The dashboard sends PostHog a report when it hits an error, containing the error's type and where in our code it happened, never what you typed. Documents on onlaycontent.com carry no analytics at all.
3. Images in comments
You can attach images to a comment. Here is what happens to them.
- Before upload, your browser redraws the image and re-encodes it as PNG or JPEG. This strips embedded metadata such as the location a photo was taken, the camera used and the time. Only the pixels are sent.
- Where they are stored. The image is stored in Cloudflare R2 object storage under the document it was posted on, together with the visitor or account id that uploaded it and the time, so that we can answer a complaint about it. Images are capped at four megabytes and 2048 pixels on the longer side.
- Who can see them. The image is served from the document's own web address under a long random name. Anyone who can open the document can see the image. The address is not guessable, but anyone who is given it can load it without signing in. Do not attach anything you would not want everyone with access to the document to see.
- The author receives them. Images are part of the feedback the document's author pulls down with the CLI, so the author and any tool they use to process feedback will get a copy.
- Deleting. Deleting your comment detaches its images immediately. The stored file is removed from storage afterwards by cleanup; until then it is unreachable through the service unless someone kept the direct address.
By attaching an image you give us permission to store it and display it in this way, as set out in the Terms of Service.
4. How we use it
We use the data above to:
- serve documents and carry comments and edits between readers and authors, which is the service you asked for (performance of a contract);
- keep the service secure, prevent abuse such as phishing pages and spam, and respond to reports (our legitimate interest, and yours);
- fix bugs and understand how the service is being used, using the logs and stored records above and not a tracker (legitimate interest);
- take payment for the Pro plan and keep the tax and accounting records the law requires (contract and legal obligation);
- contact you about your account, a change to the terms or a problem with a document you published (contract and legal obligation);
- comply with the law.
We do not sell personal data, and we do not use it for advertising or to train machine-learning models.
5. Who can see it
Other people on the document. A published document is visible to anyone who has its address unless the author restricted it. Everything posted on a document, meaning comments, the names on them, attached images and edits, is visible to everyone who can open that document, and is delivered to the document's author when they pull feedback. Authors often hand that feedback to an automated coding agent; what that agent does with it is up to the author.
Service providers listed in the next section process data on our behalf.
Legal requests. We will disclose data if the law requires it, for example in response to a valid court order, or where it is necessary to protect the rights or safety of Onlay, our users or the public.
A change of ownership. If Onlay is acquired or merges with another company, your data may be transferred as part of that transaction. We would tell you before your data became subject to a different privacy policy.
Nobody else. We do not share data with advertisers or data brokers.
6. Service providers
These companies process data for us. Each is bound by a data-processing agreement and may process data in the United States and other countries. Where data leaves the United Kingdom we rely on the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, and for data of people in the European Economic Area on the equivalent EU mechanisms.
| Provider | What they do for us | Data involved |
|---|---|---|
| Cloudflare | Serves every part of the service from its edge network, stores published documents and comment images, and keeps request logs. | Request data, documents, images, visitor cookies. |
| Convex | The database behind documents, comments, edits, grants and API keys. | Everything in section 2 except files and images. |
| Clerk | Accounts, sign-in and sessions for the dashboard, and Pro subscriptions. | Email, name, profile picture, sign-in provider, security logs; for Pro, your plan and billing status. |
| Stripe | Processes payments for the Pro plan, through Clerk. Only involved if you subscribe. | Card details, billing name, email address and country, payment history. |
| PostHog | Counts page views on onlay.io and receives error reports from our servers and the dashboard. Hosted in the European Union. | Page address, browser and screen size, country; for errors, the error type and code location. Never the text of a document, comment or edit, and never an email address. |
| Google Fonts | Serves the typefaces on onlay.io and the dashboard. Your browser fetches them directly from Google, which sees your IP address in that request. | IP address, browser version. |
Documents themselves may load resources from other origins if the author allowed it when publishing. Those requests are between your browser and that origin and are governed by its privacy policy, not ours.
7. Cookies and browser storage
We use no advertising cookies and no analytics cookies. Page views on onlay.io are counted by PostHog in its cookieless mode: nothing is written to your browser, no profile is kept, and a visit is tied to others only by a hash that PostHog rotates daily. Browsers that send Do Not Track are not counted at all. The cookies and storage we do use are strictly necessary to make the service work:
- Visitor cookie, set on each document's own address when you first interact with it. It holds a random id and nothing else, is scoped to that one document, is not readable by scripts, and lasts one year. It is what lets you edit or delete your own comment later.
- Account cookie, set on a document's address when you sign in to comment or edit a document that requires an account. It links your visit to your account for that document only.
- Clerk session cookies on app.onlay.io, which keep you signed in to the dashboard.
- Local storage on a document's address, remembering the name and email you typed so you are not asked again, and interface preferences such as whether the comment rail is open and your theme.
You can clear all of these in your browser at any time. Doing so signs you out and means the runtime will ask for your name again.
8. How long we keep it
- Documents, comments, edits and images are kept for as long as the document exists. When an author deletes a document it stops being served at once and its records are removed; the stored files are removed by cleanup afterwards.
- A deleted comment has its text and images removed immediately. If other people had replied to it, an empty placeholder stays so the replies keep their place.
- Edit history is kept for the life of the document, because that history is the product: it is what the author pulls.
- Presence records expire within minutes of you leaving a page.
- Accounts are kept until you ask us to close yours. Closing an account deletes it from Clerk and revokes its API keys. Documents you published stay up unless you delete them first, because other people may be relying on them; tell us if you want them taken down as well.
- Billing records are kept by Stripe and Clerk for as long as tax and accounting law requires, which in the United Kingdom is six years, even after an account is closed.
- Operational logs are kept by our hosting providers for a short period, typically no more than thirty days.
- Backups may hold copies for a limited time after deletion.
9. Your rights
Under UK data protection law, and similar laws in the European Economic Area, Switzerland and elsewhere, you have the right to ask us for access to the personal data we hold about you, to have it corrected or deleted, to receive it in a portable form, to restrict or object to how we process it, and to withdraw consent where we relied on it. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk; if you live elsewhere you may complain to your own data protection authority.
Much of this you can do yourself. Account holders can pull every comment and edit on their documents with the CLI, delete their own documents and comments, and edit their profile in the dashboard. Visitors can edit or delete their own comments from the document as long as their visitor cookie is intact. For anything else, including closing an account, deleting a comment you can no longer reach, or removing an email address you gave when commenting, email hello@onlay.io. We will answer within a month.
We may need to verify that a request comes from the person it concerns before acting on it. We will not discriminate against you for exercising any of these rights.
10. Security
All traffic to the service is encrypted in transit. API keys are stored only as hashes. Comment images are re-encoded in your browser before upload, checked again on arrival and served under a policy that stops them from running any code. Documents are served with a content-security policy that limits what a page can reach. Access to production systems is limited to the people who operate the service. No system is perfectly secure, and if we discover a breach that affects you we will tell you and, where required, the relevant authority.
11. Children
Onlay is not directed at children, and you must be at least 16 to create an account or post content. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes
We will update this policy when the service changes in a way that matters for your data, for example if we start sending email notifications. Material changes will be announced on the site and, for account holders, by email, before they take effect. The date at the top is the date the current version started to apply.
13. Contact
Questions, requests or complaints about privacy: hello@onlay.io.