Security & data.

Set by the person sharing, link by link, on every plan.

• Password. Proves the reader knows the password, not who they are: anyone given the password gets in. Stored only as a one-way hash.
• E-mail gate. The reader types an address, and their reading is recorded against it. On its own it proves nothing: it is the address they typed.
• Company domains and address lists. The typed address must match a listed domain or address. Only the typed text is checked, so anyone who types a matching address passes.
• One-time code. A six-digit code goes to the typed address, and the document opens only when it comes back. This proves the reader could open that inbox. It lasts ten minutes, five wrong guesses end it, sends to one address are capped, and only a keyed hash is stored.
• Expiry and switching off. A link stops working on a set date, or at once when switched off; the document is then no longer served.
• Downloads. Attached files download only if the link allows it, and every download is logged.

Once a reader has passed a gate, that browser keeps access to the link for 24 hours. No control stops someone who has opened a document from copying or photographing what is on their screen.

Documents are served from a separate domain, htmlradar.page, which shares no cookies or storage with htmlradar.com. Account holders sign in with Google or an e-mailed link. API keys are shown once, stored only as a hash, and can be read-only.

• The e-mail address typed at the gate, if the link has one, and whether it was verified.
• A random identifier, so one person opening twice counts once: a 90-day cookie, different for each document.
• When they opened it, time active, scroll depth, and time on each section.
• Country and city from the network address, which is never stored; device, operating system, browser and referring page.

Not recorded: keystrokes, mouse movements, anything outside the document, or anything identifying the reader beyond the address they typed. No third-party trackers, no session replay. Readers can opt out of tracking.

The person who shared a document sees its reading records, and so does their team's admin if they are on a team. Server checks and row-level security in the database keep each account's data from the others.

People who operate the hosted service have technical access to the database for support and abuse investigation. That access is logged and limited. Our infrastructure providers store and process the data for us, in data centres that may be outside your country, encrypted in transit and at rest.

Some usage events, such as a link being opened with the reader's country and device, but never their address or identifier, go from our servers to a product analytics service. We remove those by hand on request.

Each account chooses in Settings how long reading records are kept: forever (the default), one year, 90 days or 30 days. Older records are deleted daily and cannot be restored; documents, links and files are not touched. Deleted records remain in daily backups until those expire.

Delete document archives: nobody can open it, but its records and file are kept for recovery. For permanent deletion, write to [email protected]. Verified requests are completed within 14 days. Documents created while on a team are deleted once that team's admin agrees or the team closes.

The whole product is open source under AGPL-3.0, so your reviewer can read the source and see exactly what is collected. A company can also run it in its own accounts, so documents and reading records stay there. See self-hosting.

• No single sign-on. Each person signs in with Google or an e-mailed link; a company that needs its own login can run HTMLRadar in its own accounts from the open source.
• No certifications. The source is open for your reviewer to read instead.
• We do not publish a standard data processing agreement. If your legal team needs one, send it to [email protected] and we will read it and reply in writing.
• No service level agreement, and no promised support response time.
• No log of changes to a link's settings. Reading is recorded; setting changes are not.

Security issues: [email protected]. Privacy and deletion requests: [email protected]. Anything else: [email protected].