On this page
The short version
In this policy, "Format," "we" and "us" mean The Daily ROI LLC, the Colorado company that runs formatwriter.com and app.formatwriter.com.
- Your writing
- Yours. We store it so it saves and syncs, and show it only to people you share it with.
- Selling data
- Never. Format shows no ads.
- Tracking
- No advertising or cross-site trackers. Cloudflare Web Analytics counts page visits without cookies.
- AI training
- Format does not use your writing to train AI models.
- Leaving
- Download every paper in one file, and delete your account from the account page.
What we collect
Your papers
For each paper: its text, its sources, the heading details you type in (your name, instructor, course and school), its citation style, and which characters were typed and which were pasted.
Format also keeps the paper's edit history: every insertion and deletion, with its time and whether it was typed or pasted. The writing report and replay are built from it. In a paper written together, each edit is credited to the person who made it.
Without an account
You can write without signing up. Your papers are saved in your browser first. So they survive a lost connection and reach your other devices, they are also saved on our servers under a random library key your browser made. The server stores only a SHA-256 hash of that key, and nothing about who you are.
"Use on another device" puts that key in a link. Anyone with the link can open those papers, so send it only to yourself.
With an account
- Email address
- To sign you in, send the emails described below, and show people you write with who you are.
- Password
- Stored only as a salted PBKDF2 hash, which we cannot turn back into your password. When you choose one, the first 5 characters of its SHA-1 hash go to Have I Been Pwned to check it against known breaches. The password itself is never sent to them.
- Two-factor sign-in
- If you turn it on, your authenticator key is encrypted with AES-256-GCM under a key kept outside the database. Recovery codes are stored only as keyed hashes.
- Google or GitHub
- If you sign in with one, the account id it gives us and the email address it has confirmed. Format reads nothing else from your profile and does not keep the provider's access token.
- Signed-in devices
- For each sign-in: when it started, when it was last used, and your browser's user agent, so the account page can list "Safari on iPhone" and let you sign it out. To notice a new device, we also keep that label with when it was first and last seen.
- Plan
- Your plan, monthly or yearly, its status, when the period ends, and your Stripe customer and subscription ids. Never your card details.
- Lookups
- How many source lookups you used this month, for the Free limit. Guests are counted by library key.
- Feedback
- What you write in Send feedback, the reply address you give, if any, and the app version. It is stored and emailed to the person who runs Format so they can read it and reply. Deleting your account deletes it.
When you use Format
Every request reaches Cloudflare, which hosts Format, with your IP address and browser details. We use IP addresses to stop abuse: per-network counts of sign-in tries, saves and lookups, kept for an hour to a day.
When your account is signed in to from a new browser, the email we send you names its IP address and the rough place Cloudflare reports for it. Neither is stored.
When someone creates an account, buys Pro or cancels it, Format's operator gets an email with that account's address. A sign-up email also gives the rough place Cloudflare reports, and a sale email gives the amount charged.
How we use it
- To run Format: save and sync your papers, look up sources, export, and let people you invite write with you.
- To email you what you need: confirm your address, sign-in links, password resets, invites someone sends you, a note if a Pro payment fails, and security notes when your password changes, two-factor sign-in is turned on or off, Google or GitHub is connected, a new browser signs in, or too many wrong passwords or codes pause sign-in. No newsletters or marketing email.
- To keep it safe: rate limits, sign-in lockouts and Cloudflare's human check on the sign-up, reset and sign-in link forms.
- To bill for Pro, through Stripe.
We do not read your papers, except to fix a problem you ask us about or when the law requires it.
Cookies and your browser
Format sets only the cookies it needs to sign you in. Each is HttpOnly, sent only to Format, and used for nothing else.
__Host-format_s- Keeps you signed in. Lasts 30 days, renewed as you use Format.
__Host-format_2fa- Holds a sign-in that waits for your two-factor code. 10 minutes.
__Host-format_oauth- Protects a Google or GitHub sign-in in progress. 10 minutes.
Your browser's local storage holds your papers, your library key, your settings and any edits waiting to reach a shared paper. Format also keeps a copy of the app's own files there so it opens offline. This stays on your device. Signing out removes your account's papers from that browser; clearing the site's data removes everything.
Cloudflare Web Analytics counts visits to our pages. It sets no cookies and does not follow you to other sites. Stripe's checkout and the Google and GitHub sign-in pages set their own cookies under their own policies.
How long we keep it
- Papers
- Until you delete them. A deleted paper stays in Recently deleted for 30 days, then it is erased with its history and replay link.
- Your account
- Until you delete it.
- Sign-ins
- 30 days after you last use Format on that device.
- Email links
- Until used, or at most 7 days to confirm your address, 60 minutes to reset a password and 30 minutes to sign in.
- Abuse counters
- IP addresses and email addresses typed into sign-in: up to a day.
- Backups
- The database keeps a rolling history for recovery, up to 30 days. Deleted data can stay in it until it ages out.
- Billing
- Stripe keeps its own records under its policies and legal duties.
Download, change or delete
- Download. In the app, Export saves the open paper as PDF, Word or Markdown. Download all papers, in the documents list, saves every paper as Word and Markdown in one .zip.
- Delete a paper. Delete it from the documents list. It is erased for good after 30 days in Recently deleted.
- Delete your account. On the account page, choose Delete account and confirm with your password, plus your two-factor code if it is on. This erases your account, every paper in it with its history, replay links and shares, your sign-in methods, devices and two-factor settings, and ends Pro at once. What you wrote in someone else's shared paper stays in their paper, credited to "Former writer."
- Devices and sign-in. The account page lists every signed-in device, signs any of them out, changes your password, and connects or removes Google and GitHub.
- Anything else. Email support@formatwriter.com to ask what we hold about you, or to have it corrected or deleted.
Security
Every connection uses HTTPS. Passwords are stored as PBKDF2 hashes. Sign-in cookies, emailed links and replay links are stored only as SHA-256 hashes, and two-factor keys are encrypted. Papers are stored in Cloudflare's database; Format does not add its own encryption to them.
No system is perfectly secure. If you find a problem, please report it.
Children
Format is made for college students. It is not for children under 13, and they may not create an account. If you believe a child under 13 has given us information, email support@formatwriter.com and we will delete it.
Changes to this policy
When this policy changes, the date at the top changes with it. Before a significant change takes effect, we email everyone with an account.
Contact
Questions about privacy go to support@formatwriter.com. Format is run by The Daily ROI LLC, Colorado Springs, Colorado. The rules for using Format are in the Terms of Use.