Privacy notice
Version 2026-08-03. What we collect, why, and what we do not do.
The short version
On the free tier we do not receive your documents at all — the work happens in your browser. We do not sell or share your personal information, we do not run advertising trackers, and we do not use your documents to train anything.
Who is responsible for your data
Brevard Creek Labs, LLC, a North Carolina limited liability company is the controller of the personal data described here.
Brevard Creek Labs, LLC, a North Carolina limited liability company
tom@brevardcreek.com
If you have no account
Our web server logs the request: your IP address, the page, the time, and the browser you used. That is ordinary server logging and it is how we spot abuse and faults. The two server-side tools receive the file you send them and delete it as soon as the result comes back — it is never written to a database and the password you supply is never recorded.
What the editor reports back
Because the free editor runs on your own computer, we would otherwise have no idea whether it worked. So it sends us a short note about what happened: that a PDF was opened, how many pages it had, how large it was, which tools were used on it, whether a download succeeded, how long it took, and the text of any error.
It never sends the name of your file, and it never sends any part of its contents. That is a hard rule, not a setting — the file itself does not leave your browser, and what we receive is a description of the shape of the work rather than the work. We use it to count how many people the tools help, and to answer somebody who writes in to say it went wrong.
If you have an account
We hold your email address, your name if you gave one, a hashed password, which plan you are on, when you signed up and from what IP address, when you last signed in, which version of the terms you accepted, and the documents you have chosen to save. Payment is handled by Stripe — we hold their customer and subscription identifiers, never your card.
Why, and on what basis
To run the service you asked for, to bill you if you are paying, to keep the thing secure, and to answer you when you get in touch. That is the lot.
If you are in the United Kingdom or the European Economic Area, the lawful bases are: performing our contract with you (your account, your documents, billing), our legitimate interests in keeping the service working and free of abuse (server logs, the editor's report back), and complying with the law (tax records of what you paid).
Who else sees it
Stripe, for payment. DigitalOcean, because the servers sit there. Google, if and only if you choose to sign in with a Google account, in which case Google tells us your email address and name. Nobody else — we do not sell, share or rent anything to anyone, we do not disclose personal information for cross-context behavioural advertising, and we have not done either in the last twelve months.
Where it is kept
On servers in the United States. If you are in the United Kingdom or the European Economic Area, that means your data is transferred out of it; where that needs a legal mechanism we rely on the standard contractual clauses in our agreements with the providers above.
How long
Server logs, a few weeks. Account data, for as long as the account exists and a short while after, so that a deletion can be undone if it was a mistake. Ask us to delete an account and we will, along with the documents in it. Records we have to keep for tax, we keep for as long as the law says and no longer.
Your rights
Ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to a use of it — email tom@brevardcreek.com and we will act within a month. If you are in California: the same rights apply, we do not sell or share personal information, and we will never treat you differently for asking. Depending on where you live you may also have the right to complain to a data protection regulator, and you are welcome to — though we would rather you told us first.
Children
docubend is not for children. Do not create an account if you are under 13, or under 16 in the United Kingdom and the European Economic Area. If we find out we are holding a child's data we will delete it.
Cookies, and what is kept in your browser
Two cookies, and only once you sign in: one that keeps you signed in, and one that carries nothing but the fact that a session exists, so a page can tell whether it is worth asking who you are. Both are strictly necessary to sign you in, which is why there is no cookie banner on this site — there is nothing here to consent to. There are no analytics or advertising cookies.
The editor also remembers a few preferences in your browser's own storage — which shapes you have starred, which sets you have hidden, whether you like documents as cards or a list. That never leaves your computer and we never see it.
Changes to this notice
The version at the top changes when this text does, and we will email account holders if a change matters.