rtfx.pro

Privacy

Privacy policy

What rtfx.pro stores, why it stores it, and who can see it — written against what the software actually does rather than what a privacy policy usually says.

Last updated 14 August 2026

Operator template — not legal advice

This privacy policy describes what the rtfx.pro software actually does, and it has not been reviewed by a lawyer. It is a starting point for whoever operates this deployment, not a document a reader should treat as final or as legal advice.

Before publishing it, the operator must confirm at least: the contact address (privacy@rtfx.pro is a placeholder), the governing law and jurisdiction, the legal entity's name and address, and whether their jurisdiction requires anything this template does not carry.

The short version

  • We identify you by email address. Sign-in is passwordless: rtfx.pro emails a one-time code and magic link, and there is no password to store.
  • We store what you publish — your files, their versions, and the access list you set — because hosting them is the product.
  • We record who opened each artifact, and show that log to the artifact's owner. This is a feature of the product, and it applies to you when you open somebody else's artifact too.
  • The public pages — this one included — run no analytics, no advertising and no third-party tracking. Neither does the dashboard.
  • Nothing you publish or view is sold, shared with advertisers, or used to profile you.

Who is responsible

the rtfx.pro operator is responsible for this deployment and is the data controller for everything described below. Questions, requests and complaints go to privacy@rtfx.pro.

If you reached an artifact through a link somebody sent you, they are the one who decided to share it with you and who sees that you opened it. We host it on their behalf.

What we collect

Everything in this table is stored in this deployment's own database or object storage. There is no data collection on this site beyond it.

WhatWhere it comes fromWhy
Email address You, when you sign in or create an account with a one-time code. It is your identity here: it decides what you can open and what you own.
Account record Created on first sign-in; an admin may add a display name or note. Role, status (invited, active, paused) and workspace membership.
Artifacts you publish You, through the dashboard, the CLI, the API or an agent. The files, plus their title, slug, size, versions and version notes. This is the thing being hosted.
Access lists You, when you share an artifact. The email addresses you granted access to, per artifact.
View log Recorded when a signed-in person opens an artifact page. Viewer's email, artifact and version, path, timestamp, referring page, and the approximate country Cloudflare reports. Shown to the artifact's owner.
API tokens You, when you mint one. Name, scopes, owner, created/last-used timestamps. The token itself is stored only as a hash — we cannot show it to you again after it is created.
Signup records You, when you create a workspace. Your email address, workspace membership and plan so the account can exist and limits can be enforced.
Sign-in challenges Created when you ask rtfx.pro to email a code or magic link. Hashed code/link data, attempts and expiry time, so a short-lived code can sign you in without storing a password.
Billing records Lemon Squeezy, when a workspace changes plan. Plan, subscription/customer identifiers and status. Payment-card details stay with Lemon Squeezy, not rtfx.pro.
Infrastructure logs Cloudflare, as the network and platform serving every request. Standard request logging and abuse prevention, under Cloudflare's own terms.

What we do not collect

  • No passwords — sign-in is passwordless, so none exist.
  • No card numbers or bank details. Paid checkout is handled by Lemon Squeezy; rtfx.pro stores only plan/subscription metadata.
  • No advertising or fingerprinting. No analytics or session recording anywhere except the dashboard, and only there once you say yes — see the next section for exactly what that is and how to say no.
  • The product code does not inspect your artifacts' contents for analytics, advertising or profiling. Operators with infrastructure access may still be able to access stored files when required to operate, secure or troubleshoot the service.

Cookies and local storage

The public pages set nothing beyond what keeps the site working — no consent banner asks you to accept anything there, because there is nothing optional to accept. The dashboard adds no optional cookies at all (previous section). Everything else below is strictly necessary and cannot be declined while you use the product.

NameKindWhat it is for
rtfx_session Cookie · strictly necessary Set by rtfx.pro after you verify your email address. It is the reason you stay signed in; without it there is no dashboard session. Cleared by signing out at /logout.
__cf_bm and similar Cookie · strictly necessary Cloudflare's own bot-management and security cookies, set by the network in front of this service to tell automated abuse from real traffic. They are not used for advertising or cross-site tracking.
rtfx.cookie-notice Local storage · strictly necessary Remembers that you dismissed the cookie notice, so it does not reappear on every page. Stored locally in your browser and never sent to our server. Clearing your browser storage brings the notice back.
rtfx.dashboard-analytics Local storage · dashboard only Remembers your accept/decline choice for dashboard session recording, so the banner does not ask again. Stored locally, never sent to our server. Clearing it asks again the next time you open the dashboard.

That is the one optional cookie on this site, and it exists only because you said yes to it. Nothing else here is a choice: the public-page notice has nothing to opt out of, and the strictly-necessary rows above cannot be declined while you use the product.

Why we are allowed to process it

For readers in the UK/EEA, where a lawful basis has to be named:

  • Performance of a contract. Your email address, account record, artifacts and access lists — we cannot host access-controlled pages for you without them.
  • Legitimate interests. The view log (an artifact's owner needs to know who opened what they shared), API token metadata, and security/abuse prevention. We keep these to the minimum that serves the purpose.
  • Consent. Dashboard session recording and error tracking, which runs only if you accept it and never again once you decline.

Who can see what

  • An artifact's owner sees its view log, including the email address of every signed-in person who opened it. If you open something shared with you, the person who shared it can see that you did.
  • People you grant access to see that artifact and nothing else. A grant never reveals your other artifacts and never confers any management rights.
  • Administrators of this deployment can see the people directory and administer artifacts. This is an operator role, not a role other members hold.
  • Nobody else. We do not sell personal data, we do not share it with advertisers, and we do not use it to train anything.

Processors

Cloudflare provides the platform: the network, Workers runtime, D1 database, R2 object storage and Email Sending used for one-time-code messages. Data is processed on Cloudflare's global network, which means it may be handled outside your own country under Cloudflare's data-processing terms.

Lemon Squeezy processes paid-plan checkout and subscription events when a workspace upgrades. We disclose data to anyone else only where the law requires it.

How long we keep it

  • Artifacts and their versions — until you delete them. Deleting an artifact deletes its versions, its files and its access list.
  • View log entries — kept with the artifact, and deleted with it.
  • Your account record — for as long as you have access. Pausing an account keeps it; deletion removes it.
  • API tokens — until revoked or expired.
  • Sign-in challenges — expire after a short time and cannot be used once consumed.
  • Billing metadata — kept while the workspace exists and as needed for accounting, fraud prevention and dispute handling.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. Much of it you can do yourself: you can delete an artifact, revoke a token, or change who an artifact is shared with, from the dashboard.

For anything else, write to privacy@rtfx.pro. Note that we cannot delete the view-log entries showing that you opened somebody else's artifact without also removing the record they rely on; we will explain what applies when you ask. If you are in the UK/EEA you also have the right to complain to your data protection authority.

Security

  • Every artifact is private by default and access-controlled per artifact. An unauthorized request and a request for something that does not exist get the same 404.
  • Artifact files are served from a separate origin, so uploaded HTML can never run in the same origin as the dashboard or the API.
  • API tokens are stored hashed, scoped, owner-bound and revocable.
  • Everything is served over TLS, and sign-in uses one-time email codes and magic links rather than a password store.

No system is perfect. If you find a security problem, please report it rather than test it further — see the repository's security policy.

Children

rtfx.pro is a tool for professional work and is not directed at children. We do not knowingly create accounts for anyone under 16.

Changes to this policy

If this policy changes materially — new data, a new processor, a new purpose — the date at the top changes and the cookie notice reappears. We will not start doing something new with your data and tell you afterwards.