Privacy Policy
Version 1.0. Effective [EFFECTIVE DATE].
The short version
- Your PDF drawings stay on your own computer. We do not have them and cannot read them.
- We store the work you create about those drawings: markups, measurements, calibrations, comments.
- We look up your approximate country once, at signup, to choose a default design-vehicle library. Never again.
- We do not sell personal information and we do not train machine-learning models on your content.
- You can use Etchplan without giving us your name.
This summary is not the policy. The detail below is.
1. Who we are, and whether the Privacy Act applies to us
Etchplan is provided by [COMPANY NAME] Pty Ltd (ACN [ACN]) of [REGISTERED ADDRESS], Australia.
The Privacy Act 1988 (Cth) exempts most businesses with annual turnover of A$3 million or less. We may currently fall within that exemption. We comply with the Australian Privacy Principles anyway, and this policy is written to bind us as though the Act applied.
Privacy contact: privacy@etchplan.com.
2. Dealing with us anonymously (APP 2)
You may browse etchplan.com without identifying yourself.
To use the application you need an account, and an account needs an email address, because it is how we authenticate you and how you recover access. You do not have to give us your real name. The display name is optional, and if you leave it blank your markups show your email address rather than a name. You may use a pseudonym as your display name.
It is not practicable for us to provide the application to a wholly unidentified user, because entitlement, authorship of a markup, and recovery of an account all depend on a stable identity.
3. What we collect (APP 1.4(a), APP 3)
3.1 What you give us
| What | Why | Required |
|---|---|---|
| Email address | To create your account and sign you in | Yes |
| Display name | So a name rather than an email address appears on comments and exported drawings | Optional |
| Recovery email | So you can reach your account if your main mailbox stops working | Required when you subscribe |
| Payment details | To take payment | Only if you subscribe. Card details go directly to our payment processor and are never held by us |
| Business name and ABN | To issue a compliant tax invoice | Only if you subscribe as a business |
3.2 What is created as you work
Markups, comments and replies; measurements and scale calibrations; placed equipment blocks and their configuration; document names, page counts and page sizes; saved tools, stamps, custom blocks, categories and lists; desk settings including the country used to select a design-vehicle library; and records of which versioned safety acknowledgements you accepted, and when.
3.3 Your PDF files, which is the important distinction
On the free and paid tiers Etchplan reads your PDF files directly from a folder on your own computer, using a browser capability that requires your explicit permission. Those files are not uploaded. We do not hold them, cannot open them, and cannot recover them for you.
Two exceptions, both of which you choose:
- Cloud backup, which you switch on per document and which uploads a copy of that PDF.
- Sharing, where other people must be able to open the document and we must therefore hold a copy to serve it.
3.4 What is collected automatically (APP 1.4(b))
| What | By | Purpose |
|---|---|---|
| Approximate country, once at signup only | Our server, from a network header | Choosing a default national design-vehicle library |
| Pages viewed, features used, session activity | PostHog | Understanding which features are used and where people get stuck |
| Error reports: stack traces, browser, operating system, the failing action | Sentry | Diagnosing crashes and defects |
| Server and request logs, including IP address | Vercel, Supabase | Security, abuse prevention, diagnosis |
On the country lookup. This is the only location-related processing Etchplan performs. At signup our server reads an approximate country from a header supplied by our hosting provider, stores it against your desk, and never reads it again. We do not retain your IP address for this purpose, we do not track location over time, and you can change the stored country in settings. Signing in again does not re-run it.
3.5 Sensitive information and government identifiers
We do not seek sensitive information as defined by the Privacy Act, and we ask you not to put it into Etchplan.
We do not use government identifiers as our own identifiers (APP 9). An ABN collected for invoicing is used for invoicing.
4. Why we use it (APP 1.4(c), APP 6)
To provide Etchplan and keep your work available; to authenticate you and secure your account; to fix defects and improve the product; to communicate about your account and the service; to take payment; and to meet legal obligations.
We do not: sell personal information; use your drawings, markups or measurements to train machine-learning models; use your content to market or demonstrate Etchplan; or share your content with other customers.
5. Direct marketing (APP 7)
We may email you about your account, security, changes to the service and changes to this policy. You cannot opt out of those, because they are part of providing the service.
We will only send you product and marketing email if you have opted in. Every such email carries an unsubscribe link that works, and you can also email privacy@etchplan.com.
We do not provide personal information to third parties for their own direct marketing.
6. Who else processes it
| Provider | Role | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Australia (Sydney) |
| Vercel | Application hosting and delivery | Global edge, processing in the region serving the request. Corporate entity in the United States |
| PostHog | Product analytics | To be confirmed |
| Sentry | Error reporting | To be confirmed |
| Email delivery provider | Sign-in links and account notices | To be confirmed |
| Payment processor | Subscriptions and invoices | Added when billing goes live |
The current list is at etchplan.com/subprocessors. Each is bound to handle data only as we instruct.
7. Overseas disclosure (APP 1.4(f) and (g), APP 8)
Your account data and the work you create are stored in Australia (Sydney).
Some limited technical data is processed outside Australia in the ordinary course of delivering the service. The countries in which our providers are likely to process it are:
- United States, for hosting and error reporting
- European Union member states, where a provider's regional processing applies
We will name any additional country here before processing moves to it. If your account data would move to another storage region we will give you notice first.
8. How long we keep it (APP 11.2)
| Data | Retention |
|---|---|
| Account and desk data | While your account is open |
| Deleted documents | Recoverable by you for 30 days, then permanently purged |
| Deleted markups and comments | Purged on the same cycle, whole comment threads at a time |
| Data after account closure | Deleted or de-identified within a reasonable period, plus a 30-day export window |
| Backups | Overwritten on their normal cycle |
| Analytics and error data | To be confirmed |
| Tax and financial records | Seven years, as Australian law requires |
One exception, stated plainly. Comments or markups you contributed inside another organisation's shared drawing stay with that organisation, because they are its project record. Your name is removed and the contribution shows as being from a former user.
9. Keeping it accurate (APP 10, APP 13)
You can view and correct your account details in settings at any time. If you believe we hold something inaccurate that you cannot correct yourself, email privacy@etchplan.com and we will correct it or tell you why we disagree, in which case you may ask us to attach a statement noting your view.
10. Security and data breaches (APP 11.1)
We protect your information with encryption in transit and at rest with our storage providers; database-level access rules scoping every record to the desk that owns it; access controls limiting who at our end can reach production data; and, for most users, the fact that the PDF drawings themselves never leave their own computer.
No system is perfectly secure.
If we become aware of unauthorised access to your information we will notify you without undue delay, and in any event within five business days, tell you what we know, and tell you what we are doing about it.
Where an eligible data breach is likely to result in serious harm we will also notify the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and we commit to doing so whether or not the small-business exemption at section 1 applies to us.
11. Your rights, and how to complain (APP 1.4(d) and (e), APP 12, APP 13)
You can access what we hold, correct it, export your work, delete your account and its content, object to analytics collection, and complain.
To make a request or a complaint, email privacy@etchplan.com with enough detail to identify what you are asking about. We may need to verify your identity first.
- We acknowledge within 5 business days.
- We respond substantively within 30 days. If we need longer we will tell you why and when.
- If we refuse access or correction we will tell you the reason in writing and how to complain.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au. The OAIC will generally expect you to have complained to us first.
12. Cookies and local storage
- Essential cookies keep you signed in. The product does not work without them.
- Local browser storage remembers which folder you chose and briefly holds work before it saves. It stays on your device and we never receive it.
- Analytics cookies are used by PostHog. You can decline them with no loss of product functionality.
13. Where each APP 1.4 requirement is answered
Included so this policy can be audited rather than merely read.
| APP 1.4 requires | Answered in |
|---|---|
| (a) kinds of personal information collected and held | Section 3 |
| (b) how it is collected and held | Sections 3.4, 6, 8, 10 |
| (c) the purposes of collection, holding, use and disclosure | Sections 4, 5 |
| (d) how to access and seek correction | Sections 9, 11 |
| (e) how to complain, and how we deal with it | Section 11 |
| (f) whether we are likely to disclose overseas | Section 7 |
| (g) the countries, where practicable | Section 7 |
OAIC-recommended additions also included: applicable exemptions (section 1), retention practices (section 8), and pseudonymity (section 2).
14. Children
Etchplan is a professional tool, is not directed at anyone under 18, and we do not knowingly collect information from children.
15. Changes to this policy
We may update it. Where a change materially affects you we will give notice by email or in the app before it takes effect. Previous versions are available on request.
16. Contact
[COMPANY NAME] Pty Ltd (ACN [ACN]), [REGISTERED ADDRESS], privacy@etchplan.com