Privacy Policy

About this project

LWrite is a free, non-commercial hobby project. It is a browser-only ("local-first") rich text editor: there is no user account, no server-side database, and no cloud sync. The documents you write, your version history, and your theme and language preferences are stored only in your own browser (documents and history in IndexedDB, preferences in localStorage) and are not transmitted to us.

This means that, for the core editing features, your content never leaves your device. The sections below explain the few cases where data is nevertheless processed — mainly technical server logs at the hosting provider, which also serves the site’s self-hosted fonts.

What data is processed

• Server access data: when your browser loads the site, the hosting/CDN provider may process technically necessary access data such as IP address, date and time, the requested URL, the user agent and — where the browser sends it — the referrer, plus error, security and hosting/CDN logs.
• Web fonts: the interface and editor fonts are self-hosted and served from the same place as the rest of the site, so loading them does not contact any third-party font provider. Like any other file the site serves, these requests are handled by the hosting/CDN provider and are covered by the server access data above (see "Web fonts" below).
• Content you enter into the editor: text, formatting, imported documents and uploaded images are processed locally in your browser and saved to local storage on your device. They are not sent to a server operated by this project.
• Technically necessary local storage: the app stores documents, version history and small UI preferences in your browser. It does not set tracking cookies.
• Preferences: your selected theme (light/dark) and language are stored locally so the app remembers them.
• Printing and export: if you use the print or export function, the document is rendered in your browser and handed to your own browser/operating system (for example to a printer or a saved file). This project does not receive a copy.
• Image URLs you choose: if you insert an image by URL, your browser loads that image directly from the third-party server you chose, which can see your IP address and request details.

Legal basis (GDPR)

• Legitimate interest (Art. 6(1)(f) GDPR): operating the site securely and reliably, including technically necessary server, security and error logs, and serving self-hosted web fonts for a consistent, legible presentation.
• Performance of a function you request (Art. 6(1)(b)/(f) GDPR): carrying out actions you intentionally trigger, such as loading an image from a URL you entered, printing or exporting.
• Consent (Art. 6(1)(a) GDPR): only required for optional analytics, tracking, marketing cookies or non-essential third-party embeds. This project uses none, so no consent is requested.

Web fonts

The interface uses the "DM Sans" and "Crimson Pro" fonts, and the editor offers a font picker with a range of additional fonts. All of them are self-hosted: they are delivered from the same origin as the rest of the site, and the editor only requests an extra font once you select it or open a document that uses it. Because the fonts come from this site rather than a third party, your browser does not connect to an external font provider such as Google Fonts, and no font-related data (such as your IP address) is shared with one. No font-related cookies are set, and the fonts are used only to display text. The fonts originate from Google Fonts and remain under their respective open-source licenses.

Retention

Documents and preferences stay in your browser until you delete them, clear your browser storage, or the browser removes them. Version history is capped at a small number of recent versions per document.

Server, security and hosting/CDN logs are controlled by the hosting provider and are kept only as long as needed for operation, security and debugging, unless a specific retention period is configured by the operator or required by law.

Recipients / providers

• Hosting / CDN provider: the static site — including its self-hosted web fonts — is delivered by a hosting and CDN/security provider (for the official deployment this is Cloudflare Pages; self-hosted copies may use a different provider depending on deployment configuration).
• Image hosts you choose: only when you insert an image by URL, your browser contacts that third-party server.
• No analytics, advertising, tracking, session recording, external database, authentication provider or email-delivery service is used by this project.

Cookies and local storage

This project does not use advertising, analytics or tracking cookies and does not embed third-party analytics or tracking scripts. It only uses technically necessary browser local storage to keep your documents and preferences on your device, plus the web fonts described above. Because none of this requires consent under the GDPR, there is no cookie consent banner.

Data security

The site is served over an encrypted HTTPS connection (provided by the hosting/CDN provider). Because the editor is local-first, your documents stay on your device and are not exposed to a server. Document HTML is passed through a strict sanitizer before it is stored, restored, previewed or exported, which reduces the risk from malicious content in imported files.

International data transfers

The editing itself happens on your own device. Where server logs are processed, the hosting/CDN provider may operate infrastructure in the EU and in third countries (such as the USA), depending on deployment and routing. Such providers rely on their own safeguards (for example EU standard contractual clauses) for any transfer outside the EU/EEA. Because the web fonts are self-hosted, they involve no separate transfer to a third-party font provider.

Children

This project is a general-purpose writing tool and is not directed at children. If you are below the age of digital consent that applies in your country, please use it only with the involvement of a parent or guardian.

What this project does not do

• No advertising, no marketing, no selling or sharing of personal data.
• No analytics, no tracking pixels, no heatmaps, no session recording.
• No profiling and no automated decision-making within the meaning of Art. 22 GDPR.
• No newsletter and no unsolicited contact.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection regarding your personal data, and the right to lodge a complaint with a data protection supervisory authority. Where processing is based on consent, you can withdraw it at any time with effect for the future.

Because documents are stored only in your browser, you remain in direct control of them: you can view, change, export or delete them at any time in the app or by clearing your browser storage. For requests concerning server-side logs, please use the contact above.

Changes to this policy

This policy may be updated as the project evolves. The date above reflects the last review.