Privacy
What we receive, and how long we keep it
EarlyOffice keeps documents on your device and in your own drive. This is everything our servers receive.
The binding privacy policy is the Korean version (개인정보 처리방침), which also covers accounts, devices, sync, activity history, edit-access requests and error reports. This page is a shorter English summary of what EarlyOffice sends and stores.
Principles
- We don't take your document files. Opening and editing happen on your device.
- Only what a feature you turned on needs. Co-editing, file storage and font reports receive only the data they require.
- Signing in. The web app (also in a phone browser) and the Windows app need a Google or Apple account; a document shared with you by link can be viewed without one. Without signing in, the Mac app only opens documents read-only — editing and saving need a sign-in. Signed in or not, the content of documents you open from your device is opened and edited on the device.
- On-device translation (Android app). Translation in the Android app uses Google ML Kit on your device; the text you translate never leaves the device and is never sent to our servers. If the language model for a language (about 30 MB each) is missing, it is downloaded once from Google LLC (USA) only when you choose to download it. While downloading a model or translating, ML Kit may send Google device and app information, performance metrics and the chosen languages for diagnostics and usage analytics (never document content). We do not receive this data.
- No sign-in secrets kept. Google and Apple tokens and passwords are never stored; our own session token expires after 15 minutes.
What our servers receive
| What | When | What is kept | For how long |
|---|---|---|---|
| Sign-in | When you use the web app or the Windows app, or edit in the Mac app | Nothing (only a 15-minute session token is issued) | — |
| Co-editing changes | When a document is opened together | The edits made together | While the co-editing room exists |
| Presence | During co-editing | Name, colour, cursor (in memory only) | While connected |
| Chat and notes | When you write them | Messages (deleted messages are deleted on the server too) | As long as the document owner sets |
| Share links | When the owner turns one on | Link, role, creating account | Until the owner turns it off |
| Missing font names | Only if you turn reporting on (off by default) | Counts per font name | Kept as statistics |
| Visit counts | When a page of this site or the web app opens — not sent if your browser has Do Not Track or Global Privacy Control on | Daily totals per page path, site, phone or desktop, and referring domain. To count each day's visitors, a hash of the IP address and browser string (User-Agent) mixed with a secret used for that day only; the IP address and browser string themselves are not stored. No cookies or browser storage | The hashes and that day's secret until the next day; the totals, which identify no one, 400 days |
| Form searches that found nothing | When a search in the form library (서식 탐색) finds no form — not sent if your browser has Do Not Track or Global Privacy Control on | The search words only (at most 30 characters; anything that could identify a person — an e-mail address, a long number, a phone number — is dropped) and web or app, as daily totals; not linked to an account, IP address or cookie | The totals, which identify no one, 400 days |
| Days of use | The first request of a signed-in account each day | Date, account, platform (web, Mac …), for totals of active accounts | 90 days, or until the account is deleted |
| My file storage | When you upload | The file, its name, size and versions | Until you delete it (30-day trash) |
| AI requests | When you use an AI feature with “EarlyOffice AI” | Nothing of the text on our server: your request and the document text needed to answer it (your selection, or part or all of the document) pass through our server to an AI model provider — first Anthropic, PBC (USA), then OpenAI, L.L.C. (USA) when Anthropic cannot answer or our usage cap for it is reached; one request goes to one of them — over TLS and are not stored or logged by us. Accounts that have not yet agreed to the 25 October 2026 transfer notice are sent to OpenAI only. A hard request the default model could not solve may be sent on, with the same content, to Google LLC (USA) (Gemini API). Only request and token counts are kept. While the AI model provider cannot answer, or once our daily or monthly usage cap is reached, AI features are unavailable; accounts that have not agreed to the transfer abroad cannot use them. The web app hides the values you entered under Settings › My details before sending; other personal data written in the document is sent as it is, so do not send sensitive text to the AI. | Counts: 13 months |
| Error reports | After an app error, when you choose to send it | App and OS version, CPU type, the error and where it happened (quoted text, home-folder names, document file names and e-mail addresses removed first); not linked to an account, device or IP address | 30 days |
Font statistics never include document content, file names or accounts. Rate-limit counters by IP stay in memory and are never written to disk. Google Drive data follows the Google API Limited Use policy.
Transfer abroad
The contents of files you upload to file storage are kept, over encrypted connections, in storage (R2) run by Cloudflare, Inc. (USA). We request Asia-Pacific placement, but it is not guaranteed. File names and account data stay in Korea (AWS Seoul). If you don't use file storage, nothing is transferred, and the editor and Drive documents work as before.
Changes (29 October 2026). Added on-device translation in the Android app (Google ML Kit) to the list above: what may go to Google when you download a language model or translate (device and app information, performance metrics and the chosen languages — never the document text). What our own servers process has not changed.
AI features (from 25 October 2026, announced 18 October 2026). Anthropic, PBC (USA, Claude — privacy@anthropic.com) is added as the first AI model provider: your request and the document text needed to answer it go first to Anthropic and, when Anthropic cannot answer or our usage cap for it is reached, to OpenAI. This applies only to accounts that agree to the 25 October 2026 transfer notice (asked once at the next sign-in); until then, an account's requests go to OpenAI only, as agreed before. Anthropic keeps them for the period set by its API terms (Anthropic commercial terms).
AI features (from 13 October 2026, announced 6 October 2026). When you use EarlyOffice AI, your request and the document text needed to answer it are sent through our server, over TLS, to OpenAI, L.L.C. (USA) to generate the answer; a hard request the default model could not solve may be processed again by Google LLC (USA) (Gemini API). Our server does not store them; each company keeps them for the period set by its API data policy (OpenAI, Gemini API terms). Account data (name, e-mail, identifiers) is not sent. You agree to this transfer when you sign up; if you don't use AI features nothing is sent, and everything else works as before. Correction (6 October 2026, about 15:00 KST): the first notice said an AI server we run in Korea would answer instead when OpenAI could not; that sentence was removed — there is no fallback server, and all EarlyOffice AI requests are processed by OpenAI. Correction (6 October 2026, about 17:00 KST): Google LLC (USA, Gemini API) was added as the provider that re-processes hard requests, and the sentence about using your own API key was removed — the app offers no choice of AI provider or key.
Contact
Privacy questions and requests: help@earlyadopter.io