Know where your data goes.

Textend works with documents and files on your computer. File opening and saving use access you grant. Local-first does not mean every feature is offline, or that AI requests never include document text.

When you use AI, requests go to the service you configure. Depending on the task, they may include instructions, selected text, relevant passages, document context, and discussion content. The scope must be disclosed in the product and authorized by you. Assess a provider before sending sensitive material.

AI providers govern their own data use, retention, processing locations, and deletion under their terms. Web search and source-reading features may also access external services.

The app uses operating-system secure storage to protect API keys. Runtime diagnostics and AI interaction records may contain request and response content. AI interaction records are stored locally by day, up to 10 per day, with entries older than 14 days pruned on writes. Local discussion-event logs have a roughly 14-day retention period and size caps; startup diagnostics rotate by size. Review and redact any material before sending it to support. Never attach keys, private drafts, or unredacted logs to public reports.

The website, textend.app, is hosted on Cloudflare Pages. Reading product information requires no Textend account. Hosting services may process request information such as IP addresses under their policies. GitHub stores website source code, not your documents or licensing data.

When you submit your purchase email in My licenses, the license service sends a short-lived email code. Before verification, responses do not disclose purchase details. After verification, view that mailbox’s licenses, select one to retrieve its key and devices, and confirm deactivation of an old device. Two random browser-session identifiers bind operations without reading hardware identifiers or identifying a device. Codes, keys, and session data remain in page memory rather than URLs, cookies, or browser storage. Sign-out, expiry, or reloading requires verification again. The original request determines the session expiry; operations do not extend it. Copied keys enter the system clipboard, which you control. The license service retains email requests, rate-limit, security, and necessary license records under the applicable retention rules.

Before purchase, the license service uses Resend to verify the email you submit. A short-lived purchase proof links the verified email to a durable purchase record, quote, and payment-provider order. Buying another license with the same email requires explicit confirmation. Codes and purchase proofs remain in page memory rather than URLs, cookies, or browser storage. Reloading or expiry requires verification again without deleting or charging the original order again. Minimal reconciliation and duplicate-payment records are retained; a timeout alone does not cancel a payment.

Website purchases use Waffo Pancake for payments, orders, transaction receipts, and refunds. When you purchase or use licensing services, Cloudflare Workers/D1 processes order identifiers, purchase email addresses, license status, device digests, and random installation IDs; Resend delivers license and recovery emails. Pancake does not activate the software, and Resend does not decide Pro entitlement. Licensing does not require documents, AI keys, or full card details.

Recovery codes expire 15 minutes after the request. Recovery records older than 24 hours with no active processing lease are cleaned during the next enabled recovery operation or reviewed manual maintenance. A stopped service does not guarantee deletion at exactly 24 hours. Orders, original licenses, and necessary email-safety records are outside this short-term cleanup.

Trials do not use the payment system or require an account or email address. The app converts the operating-system device identifier locally into a digest specific to Textend; the original identifier is not uploaded. The digest remains device-identifying information, not anonymous data. Trial and licensing services store device digests, random installation IDs, trial start and end times, and purchased-license activation relationships to prevent repeated trials on one device and manage each license’s three-device limit. Purchased licenses also retain necessary order and customer identifiers, purchase email, encrypted license delivery, license status, and covered versions for delivery, recovery, and refunds. Computer names and usernames are not read automatically, and your writing is not collected. You may supply an optional device name in My licenses. Names are encrypted in the licensing service for identification, can be changed or cleared, and are removed with that license’s personal data. The device code shown in the app and on the website is derived from the existing device digest for matching only; it grants no access.

A one-time license does not expire under a short retention calendar. Minimal records needed for continued activation and recovery, refunds, disputes, duplicate-issuance prevention, and email safety will be retained for those purposes; unnecessary detailed content will be reviewed. Delivery, bounce, and complaint records support delivery and prevent further problematic mail, without open or click tracking. Pausing email does not revoke a purchase.

After app data is cleared or the app is reinstalled on the same device, the trial service returns the original dates. Deactivating a purchased license does not erase trial history. Device digests cannot guarantee protection against identifiers forged by modified systems or virtual environments. Contact support for hardware changes, an unreadable identifier, or an incorrect match; basic editing and saving remain available.

Unnecessary diagnostic detail and duplicate frozen message content will be reviewed manually each week after processing has been complete for 90 days, with minimization only when safety conditions permit. Unknown completion dates, unresolved disputes, processing tasks, uncertain sending outcomes, and negative email feedback retain the scope needed for investigation. Order idempotency identifiers, refund status, and the recoverable original license do not expire under this rule. Minimal handling records prevent older backups from restoring removed content. Ninety days is a review threshold, not a universal deletion deadline for licensing or email data.

Support messages you choose to send are handled in our Gmail support inbox. Provide only your purchase email, an order reference if available, and necessary redacted material; do not send identity documents, full card numbers, API keys, or private writing. We record case closure and review unnecessary content, attachments, and known working copies monthly once a case has been closed for 180 days, with individual messages or materials as the scope. Unresolved disputes and other necessary records retain their reasons and are reviewed periodically; minimal handling receipts do not copy original content or attachments. Recoverable messages in Trash are not treated as removed. This is manual review, not a guarantee that all material disappears automatically on day 180.

When the licensing service has writes, backups will be captured and verified manually each day and before changes or data handling. A rolling 30-day policy retains at least one verified recovery point; expired copies are reviewed after a new backup succeeds. Failed backup checks preserve the old point while the fault is handled, so the minimum recovery copy may remain beyond 30 days until a new point succeeds. Backups and keys are kept separately in private storage, outside public downloads; historical decryption keys and deletion journals do not expire with ordinary snapshots. Adopted data minimizations are reapplied before restoring older backups. Backups are captured and verified manually; this policy does not promise automated backups or off-site disaster recovery.

Contact the address below, with your purchase email; include an order reference if available. We will verify purchase ownership and the requested scope. An order screenshot or knowledge of a license identifier alone does not authorize access to another person’s data. Changing a purchase email requires separate verification of the old and new addresses and payment-order relationship.

Before deletion, we will explain its scope, retention reasons, and effects. Removing licensing contact or installation data may prevent online activation, refresh, recovery, or moving a license to another computer. Necessary refund, dispute, duplicate-issuance, and repeat-trial prevention records may remain. Previously issued offline credentials cannot be erased remotely at once. Licensing-data deletion neither deletes your local writing nor constitutes a refund. Third-party payment, email, and hosting records follow their own processes. We will explain the completed scope and any retained categories and reasons, and handle requests under applicable requirements.

The operator is based in China. Cloudflare hosts the website and licensing service; Waffo Pancake handles website payments; Resend sends license and recovery mail; Google Gmail handles support email. External services may process data outside your country or region. Resend currently states that message content and logs are stored in the United States; selecting a sending region does not restrict storage to that region. See each provider’s policies for other processing locations, retention, and request channels.

Cloudflare · Waffo Pancake · Resend · Google

Provider information does not establish Textend’s retention settings or certify compliance everywhere. Completing a Textend action does not erase all provider or recipient copies at the same time.

Textend is maintained by Wang Yuan (王远), an individual developer based in Guilin, Guangxi, China. For privacy questions or data-handling requests, contact: