Privacy

readthis.md stores what it needs to show your documents to the people you share them with, and nothing else.

Last changed 8 November 2026.

Who is responsible

1612987 B.C. Ltd., doing business as readthis.md, 6583 Acorn Rd., Sechelt BC V7Z 0N3. Write to contact@readthis.md.

The operator is responsible for the personal information readthis.md holds, and its privacy officer answers questions and requests about it at that address.

What is stored, and why

• Your email address, and the addresses you share documents with or ask for feedback, to sign people in and send them what was shared with them.
• Your documents and comments, with who wrote or saved each and when, to keep them and show them to the people you share them with.
• Who each document is shared with, the agents and API keys you connect, and the browsers you are signed in to. Sign-in codes and keys are stored only as one-way fingerprints.
• How much room your documents take, when each was last used, and when you last used readthis.md and on what kind of device, to apply your limits and the trash and to count active people.
• When you subscribe, Stripe’s ids for you and your subscription, and when it renews or ends.
• Which version of the terms you accepted, and when.
• Counts by day with nobody in them: visits to the public pages, the sites visitors came from, and how many people were active and on what kind of device. No count can be traced to anybody. They are kept for 13 months.

For people in the European Union and the United Kingdom, the lawful basis is the agreement with you, and the operator’s legitimate interest for the record of the terms, protecting readthis.md and the counts.

What is not done

No advertising, no selling of personal information, and no tracking: no cookies but the ones that keep you signed in, no scripts or analytics run by anybody else, and nothing in an email that loads from anywhere. readthis.md never asks for your name, a password or a card number, and emails you only about documents and your subscription.

readthis.md does not log IP addresses. It holds the one a request came from in memory, briefly, to slow down anybody guessing at sign-in codes. The web server in front of it can record one in its error log, which is kept for 7 days. The server’s own log names no IP address, key or sign-in code, and keeps only its newest lines.

Where data lives

On the operator’s server, and with these companies, each handling only what its part needs:

• OVHcloud runs the server and its disk, in Canada.
• Backblaze B2 keeps the encrypted backups, in Canada; it cannot read them.
• Google Workspace sends readthis.md's email, from Google's servers, which may be in the United States or elsewhere outside Canada.
• Stripe sells the subscription, through its Link service, as the merchant of record. It holds your card details, billing address and the email you pay with, under its own privacy policies at link.com/privacy and stripe.com/privacy. The operator can see in Stripe the name, address and email you paid with, and what you paid.

Where one of these companies is outside Canada, your information is held in that country too, and its courts and authorities can lawfully require access to it. For people in the European Union and the United Kingdom, both recognise Canada as protecting personal information adequately.

Every hour an encrypted copy of the database goes to the backup store, which cannot read it. Backups are kept for up to 60 days.

How long it is kept

A document, with its versions and comments, is kept until its owner deletes it or its days in the trash are up. Everything else of yours is kept until you delete everything. Either way, it then leaves the backups within 60 days. Versions you saved in other people’s documents stay in their history, as saved by a deleted person.

Two things are kept after you delete everything, and neither holds your address: the record of which terms you accepted, as evidence of what was agreed, and a fingerprint that lets a payment arriving after you left be cancelled rather than kept.

Your rights

You can ask for a copy of the personal information readthis.md holds about you, ask for it to be corrected or deleted, and object to how it is used, by writing to contact@readthis.md. Much of it you can do yourself: Download a copy gives you a document whole, and Delete everything, in the settings behind your address, removes what is yours. What a payment left with Link, ask Link to delete.

If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), to British Columbia’s Information and Privacy Commissioner (oipc.bc.ca), or, in the European Union or the United Kingdom, to the data protection authority where you live.

Changes to this page

A change to what is stored, why, or who handles it is emailed to everybody who owns a document before it applies.