Draft, not legal advice. This describes what the product actually does today, to the best of a code-level audit. It has not been reviewed by a lawyer, doesn't claim compliance with any specific law (GDPR, CCPA, or otherwise), and uses placeholders where company and jurisdiction details belong. Have it reviewed before launch.

Privacy Policy

Version 2026-08-09 · Last updated 2026-08-09

Visual HTML Editor is used by people around the world. This policy describes what we actually collect and why, in plain language, regardless of where you're located.

1. Who we are

Visual HTML Editor is provided by [PLACEHOLDER: legal company name], registered at [PLACEHOLDER: registered address]. For privacy questions, contact [PLACEHOLDER: contact email].

2. Editing HTML doesn't require an account

You can upload, edit, and export HTML without ever creating an account. In that mode:

Your uploaded HTML is loaded and rendered in your browser, inside a sandboxed frame. It is not sent to our servers.
A working draft is saved to your browser's own local storage (IndexedDB) so you don't lose it on a refresh. This never leaves your device.
Exporting to HTML or PDF happens entirely in your browser -- the file is generated and downloaded locally, not uploaded anywhere.
The built-in sample document is a static file bundled with the app, not your data.

Clearing your browser's site data for this app removes any drafts you haven't explicitly saved to an account.

3. What changes once you create an account

If you create an account and use Save, Share, or "My projects", we additionally store:

The HTML of pages you explicitly save, in our database, associated with your account, so you can reopen and re-edit it later.
The HTML of pages you explicitly publish ("Share"), served publicly at that page's own link so anyone with the link can view it, until you unpublish or delete it.

Uploading, editing, and exporting a page still work exactly as described above whether or not you're signed in -- an account is only required for the Save/Share features specifically.

4. Account information

When you create an account, we store:

Name, email address, and account ID -- provided by you (email/password sign-up) or by Google (if you sign in with Google, we receive your name, email, and profile image from your Google account).
Password -- if you sign up with email and password, your password is hashed before storage; we never store or can see your plaintext password.
Which version of these Terms/this Privacy Policy you accepted, and when -- so we have a record of what you agreed to.
Session data -- when you're signed in, we store a session record that includes the IP address and browser/user-agent string associated with that sign-in, used for session security (e.g. detecting anomalous activity) and kept for as long as the session is active plus a short retention window afterward.

We do not ask for or collect marketing or newsletter consent -- there isn't one to give.

5. Cookies

See the Cookie Policy for the full list. In short:

Necessary cookies (always on): keep you signed in and remember your language. The Service doesn't work without these.
Optional cookies (only after you accept the cookie banner): a random, non-identifying visitor ID used for the usage analytics described below.

6. Usage analytics

We track a small set of product usage events -- for example, that a page view happened, that an upload completed, that an edit was made, that an export ran, or that an account was created -- to understand how the product is used and to improve it. Each event records:

The event name and the time it happened
An anonymous visitor/session identifier (a random ID stored in a cookie, or your account ID if you're signed in)
The page path the event happened on
Small, fixed-shape metadata where useful (for example, which format was exported)

We never include in analytics:

The contents of any HTML file you upload, edit, or export
Filenames or document titles
Passwords or authentication tokens
Any other content from your files

This tracking only runs after you accept the optional-cookies banner. We also use Vercel Web Analytics and Vercel Speed Insights for aggregate traffic and performance metrics (also gated behind the same consent), which is separate infrastructure operated by our hosting provider.

7. Server logs

Like virtually every web service, our hosting and database infrastructure providers generate standard operational logs (e.g. request timing, error logs, IP addresses at the network level) as part of running the Service. These are operational/security logs, not a product feature we built, and are retained according to our infrastructure providers' own default policies.

8. Third-party service providers

We use the following categories of third-party providers to operate the Service. Exact vendors may change over time; this list reflects what's in use as of the version date above.

Hosting -- Vercel (application hosting, Web Analytics, Speed Insights)
Database -- Neon (managed Postgres) for account and saved-page data
Sign-in -- Google (if you choose "Continue with Google")
Transactional email -- Resend, used only to send account-related email (e.g. password reset), not marketing

These providers may process data on infrastructure located in different countries than you, which can mean your data is transferred internationally as part of normal operation. We haven't restricted our provider selection to any single region. [PLACEHOLDER: specific international-transfer safeguards, if any are legally required for your user base, need a legal review -- not addressed here.]

9. Data retention

Account data (name, email, account ID) is kept while your account exists.
Saved and published pages are kept until you delete them or delete your account.
Usage analytics events are kept to support product analysis; we haven't yet set a fixed automatic deletion window for them. [PLACEHOLDER: decide and document a retention period for analytics events.]
Local drafts in your browser's storage stay until you clear them or your browser does.

10. Account deletion

You can delete your account at any time from Account settings. Deleting your account deletes your account record and all pages you saved or published under it. Some records (for example, past events attributed only to your account ID, kept for product-analysis purposes as described above) may be retained in de-identified or aggregate form.

11. Your rights

Wherever you're located, we want you to be able to understand and control your data. You can:

See your account's name and email in Account settings at any time
Request an export of your account data (see Account settings)
Delete your account and its content at any time
Contact us at [PLACEHOLDER: contact email] with any other privacy request

Depending on where you live, you may have additional legal rights (such as rights to access, correct, or object to processing under laws like the EU/UK GDPR, or the right to opt out of the sale/sharing of personal information under US state laws like the CCPA). [PLACEHOLDER: this section needs a legal review to state which specific rights apply to which users, and to add any required regional-specific language (e.g. a "Do Not Sell or Share My Personal Information" mechanism, if applicable).]

12. Security

We use industry-standard practices to protect your data -- passwords are hashed, not stored in plaintext; sessions use secure, signed cookies; and access to your saved pages is restricted to your account. No method of storage or transmission is perfectly secure, and we can't guarantee absolute security.

13. Children

Visual HTML Editor is not directed at children. [PLACEHOLDER: define a minimum age appropriate to your target markets and applicable law.]

14. Changes to this policy

We may update this policy as the product changes. We'll update the version date above when we do, and for material changes affecting existing accounts, we may ask you to review and re-accept.

15. Contact

Questions about this policy or your data: [PLACEHOLDER: contact email]