PRIVACY POLICY
Your data, exactly.
This page lists what we hold, why, and for how long. It is short because we hold little. Last updated 8 October 2026.
Who is responsible
Redline PDF, reachable through Redline PDF support, is the data controller for this service. Redline PDF is operated from the United Arab Emirates. The operator's registered name is given on request, and in any formal data-protection request.
What we store, and why
| What | Why | How it is held |
|---|---|---|
| Email address | To identify your account and to send the verification codes and requested sign-in links. | In plain text; it is your sign-in name. |
| Password | To let you sign in. | Never stored as typed: only a salted scrypt hash. A password you choose is first checked against a public list of leaked passwords, without the password leaving Redline (see below). |
| Email sign-in links | To prove access to your email and sign you in. | Only a token hash, your email, expiry and signup source. Links expire after 15 minutes and are removed on use or a later authentication cleanup. |
| Invitation requests | To send the trial invitation you ask for from our pages. | Your email address, the campaign tag or referring site you arrived from, and a hash of each link sent. Kept for a month after the last link expires, or, once you use it, as long as the account it opened. |
| Trial record | So that each email inbox has one free trial. | A keyed fingerprint of the address: a one-way digest, from which the address cannot be read back. Letter case, a +tag and Gmail's dots are ignored, so variations of one inbox give one fingerprint. Kept with the date the trial started, and the date it was restarted, if it was. |
| Recovery code | To let you reset a forgotten password. | Only its hash. We cannot read the code back. |
| Your drawings, markups, checkpoints and preferences | To give you your workspace. | Encrypted at rest with AES-256-GCM, bound to your account so one account's data cannot be read as another's. This is server-side encryption: the service holds the key in order to serve you your own work. |
| Session cookie | To keep you signed in for up to seven days. | A random token in an HttpOnly, same-site cookie; the server keeps only its hash. |
| Account marker cookie | So the public pages do not offer a free month to a browser that already has an account. | Holds only the value "1": no address, name or identifier. Set when you open or sign in to an account, kept for up to a year, and cleared when you sign out. |
| Store app marker | So the account menu in the Redline app from the Microsoft Store can offer a way to rate it there. | Kept in your browser's own storage on that device and never sent to us. Holds only the value "1": no address, name or identifier. Set when Windows opens the Store app, and kept until this site's data is cleared from the browser. |
| Preferences kept in your browser | So the pages remember a few small choices on that device: the desk view you picked (sheets or a list), whether you closed or asked for the invitation card and when, the starting task you chose before signing up, the getting-started panel's task and whether it is open, that this browser has opened an account, and, if you choose Keep a copy on disk in the editor, which file on your computer to write to. | Kept in your browser's own storage on that device and never sent to us. No email address, name or drawing contents: the getting-started panel's state is filed under your account's internal number, the starting task is used only within the hour it was chosen, the account flag holds only the value "1", and the copy on disk is kept as the browser's permission to write to the file you picked. Kept until this site's data is cleared from the browser, or, for the copy on disk, until you stop it. |
| A drawing opened while signed out | So a drawing you open from your computer with the installed Redline app, while signed out, opens in the editor once you have signed in. | Kept in your browser's own storage on that device and taken once by the editor after you sign in; it reaches us only when the editor opens it in your workspace. One not taken within an hour is never opened, and is cleared the next time the workspace page opens. After it is taken, only its file name, size and date stay there, so a reload does not open it twice. |
| Emails sent because someone asked | So that sign-up codes, sign-in links and invitations cannot be used to flood an inbox or use up the email we can send, and so we stop writing to an address that bounces or reports our email as spam. | A keyed fingerprint of the inbox (a one-way digest, from which the address cannot be read back; as in the trial record, a +tag and Gmail's dots are ignored) and of the connection that asked, with the time and whether a code or link, a note, or nothing was sent: kept for one day. Resend's reference for each message, with a fingerprint of the exact address it went to: kept for three days, so we can ask Resend whether it was delivered. If a message bounces or is reported as spam, that address's fingerprint is kept for thirty days, and nothing more is sent to that exact address until then. |
| Connection address | To limit repeated sign-in attempts, the emails one connection can ask us to send, and feedback sent without an account. | Used at the moment of the request. An IPv6 connection is counted by its /64 block, the range one home or server is normally given. A hashed counter is kept for at most fifteen minutes for sign-in, and for a day for emails and feedback; never tied to your drawings. |
| Subscription status, plan and a Paddle customer reference | To know whether your account has access, and to which plan. | Received from Paddle's signed notifications. We never see or store your card details. |
We collect your email address only to identify your account and to send the verification codes and requested sign-in links; we do not use it for marketing. We keep cookie-free, aggregate counts of visits to each public page per day, and the campaign tag or referring site that a sign-up arrived from, so we can see what brings people here. Those counts separate people from automated readers such as search and AI crawlers, which are counted by the name they give; nothing about a visitor is recorded either way. We also record the first successful drawing save and a browser-reported PDF export event for an account, to understand whether signup leads to use. These events contain no drawing contents or names. A small first-party script keeps the campaign tag or referring hostname in tab storage until signup; when Windows opens the Redline app from the Microsoft Store, the source it keeps is the Microsoft Store. There are no third-party trackers, no visitor identifiers, and no cookies other than the session and the account marker described above.
Payments
Subscriptions are handled by Paddle.com as merchant of record. When you pay, Paddle collects the details a payment needs — card, billing address, tax information — under Paddle's privacy policy. Paddle tells us that a subscription exists, which plan it is on, its status, when its paid period ends and its customer reference; nothing more.
Where it lives
The service runs on Render's infrastructure in Frankfurt, Germany, on encrypted storage. Render takes a snapshot of that storage every day and keeps it for at least seven days. How the data is protected on the way and at rest is on the security page.
How long we keep it
- While your account exists: for as long as you keep it.
- After you delete your account: your data is kept, still encrypted, for thirty days so a mistaken deletion can be undone, then erased for good. Backups age out on their own schedule after that.
- After an account is erased: we keep a keyed fingerprint of its email address (a one-way digest, from which the address cannot be read back) and the dates its trial started, so each inbox gets one free trial. Nothing else about the person is kept.
- A sign-up that is never finished: the emailed code stops working after ten minutes and is deleted at the next cleanup; the address, and where it arrived from, are deleted after seven days.
- Sign-in rate-limit counters: fifteen minutes. Email and feedback counters: one day. Resend's message references: three days. The fingerprint of an address that bounced or reported spam: thirty days.
Your rights
- Access and portability: download any drawing from your workspace at any time, as a portable project file that Redline can reopen.
- Correction: change your password from your workspace.
- Deletion: delete your account from your workspace; see above for the thirty-day window.
- Anything else, including questions and complaints, through Redline PDF support. If you live in a jurisdiction with a data-protection authority you may also complain to it.
Who else sees it
Our service providers are Render for hosting, Paddle for payments, and Resend for delivering account emails. Render carries the site's traffic through Cloudflare's network, which Render names among the subprocessors of its platform. Resend receives the destination email address and message, including requested verification codes or sign-in links; afterwards we ask Resend, by the message's reference, only whether it was delivered, bounced or reported as spam. When you choose a password, Have I Been Pwned's leaked-password service receives the first five characters of its SHA-1 hash, a prefix shared by hundreds of leaked passwords, so we can tell you if yours is one of them; it never receives the password or your email address. Before we write to an address we ask the internet's domain name system whether the domain after the @ can receive email, so a mistyped address is caught at once; only that domain is looked up, never the name before the @. An address on a public list of disposable-email domains opens a Free account without the Pro trial; that check is made on our own server and tells no one anything. The Microsoft Store badge on our pages is served from our own site, so Microsoft hears from your browser only if you follow it to the Store. We do not sell or share your data, and we do not use it to train anything. The security page sets out how the service protects your data, and the certifications our providers state.
Changes
If this policy changes in a way that matters, we will show a notice in your workspace before it takes effect.