Privacy Policy

Effective date: 2026-05-27 · Last updated: 2026-06-01

30-second summary: EffortlessDoc does not require an account, does not store your input text after the AI returns its answer, does not use advertising cookies, and does not sell or share personal data. We collect anonymous usage counters (e.g. "the resume template was used 42 times today") with no link to who you are. Read on for the details.

1. Who this policy applies to

This Privacy Policy applies to your use of EffortlessDoc (the "Service") at effortlessdoc.com, including the document builder, the export tools, the contact form, and the internal stats page. It is written in plain English so you can actually read it.

2. Data we collect

2.1 Document inputs you paste into the Builder

When you click Generate or Polish & Correct, the text in the input box is sent over HTTPS to our Vercel Serverless Function (/api/generate), which immediately forwards it to DeepSeek (our AI provider) to produce a response.

We do not store this text on our servers �?it lives in memory only for the few seconds it takes to round-trip the API call, then it is discarded.
DeepSeek may retain the request under their own retention policy. Review DeepSeek's privacy policy before pasting anything sensitive.
Do not paste passwords, government ID numbers, payment-card data, classified information, attorney–client privileged content, or protected health information.

2.2 Anonymous product analytics

To understand which templates are useful and roughly how many people visit (so we can decide where to invest engineering time), the front-end fires small events to our /api/track endpoint, which writes aggregate counters into Upstash Redis. We record:

What	Example	Why
Event type	`page_view`, `template_select`, `generate`, `copy_used`, `reset_choice`, `generate_error` �?/td>	Understand which features actually get used.
Template name	`essay_argumentative`, `cover_letter_professional`, �?/td>	See which templates are popular so we can improve them.
UV (unique visitor) estimate	A random UUID stored in your browser's `localStorage` under key `cd_vid` �?written into a Redis HyperLogLog, which only stores a probabilistic count, not the IDs themselves.	Estimate daily unique visitors without tracking individuals.
Browser meta on first page view	User-Agent, screen size, language, referrer (truncated to 200 chars)	Sent for diagnostic logging only; not persisted to Redis hashes.

None of these counters contain the text you typed, your name, your email, your IP, or any other content from your documents.

2.3 Browser-local preferences (LocalStorage)

The Service writes the following keys to your browser's localStorage �?they never leave your device:

cd_vid �?a random UUID used for the anonymous UV count above.
cd_template_stats �?your local usage counts, so the "Welcome back, continue with X?" prompt can show your last template.
cd_aidb_dismiss_until �?a timestamp so the AI disclaimer banner stays dismissed for 7 days after you close it.
cd_admin_token �?only set on /stats.html when the site operator logs in.

You can wipe all of these any time via your browser's "Clear site data" feature.

2.4 Server-side logs

Vercel (our host) automatically records standard HTTP access logs (timestamp, path, status code, IP, User-Agent) for every request, the same as any web server. These logs are accessible only to the operator, retained per Vercel's defaults, and used only for debugging and abuse prevention. See Vercel's privacy policy.

2.5 The Contact form (only if you use it)

If you submit the feedback form, your message �?and your name and (optional) email �?is sent to Formspree, which forwards it to the operator by email. We only see what you voluntarily type into that form.

3. Data we do not collect

�?No user accounts, no usernames, no passwords.
�?No persistent storage of your input or generated documents on our servers �?close the tab and it's gone.
�?No email address required for the Builder (only optional in the Contact form so we can reply).
�?No advertising or tracking cookies, no third-party trackers (no Google Analytics, no Facebook Pixel, no Hotjar, etc.).
�?No fingerprinting (no canvas/audio/font fingerprinting).
�?No selling, renting, or "sharing" of personal data with brokers or ad networks.
�?No biometric, health, or financial data collection.

4. Third-party services we rely on

We use the minimum set of vendors needed to deliver the Service. Each one only receives the specific data described below.

Vendor	What it does	What it receives	Their policy
DeepSeek	Runs the AI model that writes your documents.	The text you paste into the Builder, plus the template prompt.	platform.deepseek.com
Vercel	Hosts the website and runs the Serverless Functions.	Standard HTTP access logs (IP, UA, path, status).	vercel.com/legal/privacy-policy
Upstash Redis	Stores aggregate, anonymous event counters for our internal stats dashboard.	Event names, template names, anonymous UV UUIDs (via HyperLogLog).	upstash.com/trust/privacy.pdf
Formspree	Delivers Contact-form messages to the operator by email �?only when you actively submit the form.	Whatever you type into the form (name, optional email, message).	formspree.io/legal/privacy-policy
jsDelivr / cdnjs / unpkg	Serve open-source JavaScript libraries (Chart.js, jsPDF, html2canvas, docx) from public CDNs.	Standard CDN request metadata (IP, UA).	See each CDN's site.
Pixabay CDN	Serves the (muted-by-default) background music tracks.	Only contacted if you actively press Play on the music widget.	pixabay.com/service/privacy

5. Your rights

Because we don't store your input text or any account, there is usually nothing to "delete" �?closing the tab already accomplishes that. For everything else (the anonymous counters, server logs, Formspree submissions, browser localStorage) you can:

See what's on your device: open browser DevTools �?Application �?Local Storage to inspect every key we set.
Wipe local data: use your browser's "Clear site data for this site" feature, or open localStorage.clear() in DevTools. This resets your anonymous UV ID, the welcome-back prompt, and the dismissed-banner state.
Ask us to remove a Contact-form submission or query what we hold: submit a request via the Contact form; we'll respond within 30 days.
Object to anonymous analytics: use any standard browser extension that blocks /api/track, or visit with JavaScript disabled. The Builder will still load, but the analytics ping will not be sent. (Note: blocking /api/track does not affect document generation; that uses a separate endpoint.)

Depending on your jurisdiction (e.g. GDPR in the EEA/UK, CCPA in California), you may have additional rights such as access, rectification, portability, restriction, and the right to lodge a complaint with a supervisory authority. We honour these �?contact us via the Contact form.

6. Children's privacy

🔞 The Service is intended for users aged 18 and over, consistent with the age notice shown on the home page and in the Terms of Service.

We do not knowingly collect any information from children under 13 (or the equivalent minimum age under your local law, e.g. 16 in the EU under GDPR-K). Minors between the minimum age and 18 must have verifiable parent or guardian involvement, and a parent/guardian must review every AI-generated document before submission.

If you are a parent or guardian and believe your child has provided us with information through the Contact form, please contact us via the Contact form and we will delete it promptly.

7. Security

All traffic is served over HTTPS (HSTS preloaded). API endpoints set strict CSP, X-Frame-Options DENY, Permissions-Policy and Referrer-Policy headers. The stats dashboard is password-gated and not indexed by search engines. That said, no system is perfectly secure �?please do not paste sensitive data into the Builder.

8. International transfers

Our vendors (Vercel, DeepSeek, Upstash, Formspree, the CDNs) operate globally and may process data outside your country of residence. By using the Service you acknowledge this transfer.

9. Updates to this policy

If we materially change how we handle data, we will update the Effective date at the top of this page and, where appropriate, highlight the change on the home page. Continued use of the Service after the change constitutes acceptance.

10. Contact

Privacy questions, deletion requests, or general data-protection enquiries: please use the Contact form on the main site. We aim to reply within 30 days.