Privacy policy · Dawn Doc

This policy explains what Bit Direction Ltd ("we", "us") collects when you use the Dawn Doc app, this website (dawndoc.com) and the licence service behind it, why, and what you can do about it. Bit Direction Ltd is a company in New Zealand. You can reach us at support@dawndoc.com.

In short

Dawn Doc works on your own computer. We never receive your documents.
The app contacts us only when you activate or deactivate a licence.
We set no cookies on this website and run no analytics or advertising.
Paddle, our reseller, handles payments under its own privacy notice.

The Dawn Doc app

Dawn Doc sends data only when you activate or deactivate a licence: the licence key, a hash of the device's ID, a device name (editable; it defaults to the computer's name), the platform and the app version. Apart from that, the only network traffic is loading the web images a document links to (as any Markdown viewer does). It works offline otherwise.

When you deactivate, the app sends the licence key and the licence file it holds for that computer instead of a new activation. The file carries the same device hash and the email address the licence was issued to.

The device hash is made from your computer's own ID by a one-way function: it tells the licence service one computer from another without revealing that ID. The images a document links to are fetched from wherever the document says, and those servers see the request, as they would in any browser.

The free trial needs no account. It is counted on your computer, and nothing about it is sent to us.

This website

We set no cookies and run no analytics. We don't track your visits.
Hosting. Amazon Web Services serves the site through Amazon CloudFront. We have not turned on request logs for the site.
Downloads. The Download page reads the list of installers from downloads.dawndoc.com, and the installers download from there.
Checkout. The Pricing page loads Paddle.js, Paddle's script that opens the checkout. What you enter at checkout goes to Paddle, not to us. Paddle's script and checkout are Paddle's own: what they store in your browser or collect is covered by Paddle's privacy notice, not by this policy.
Offline activation. The Activate page sends the licence key, the request code from the computer you are activating (it carries that computer's device hash) and a device name, if you type one, to the licence service, and gives you the licence file back. The service keeps what it keeps for any activation (below).
Your account page. You give it your email address, and we email you a sign-in link. Signing in keeps a session in your browser's session storage, which your browser clears when you close the tab. Signing out removes it from your browser at once; the session itself stops working an hour after you signed in at the latest.

The licence service

Our licence service (api.dawndoc.com) keeps:

Your email address, from your Paddle order or the address we issued a licence to, so that we can send your licence key and you can sign in to your account page.
Your licences: an internal ID, a one-way hash of each key (never the key itself), where the licence came from, Paddle's ID for your purchase, its status, and when it was issued or expires.
Each computer you activate: its device hash, the device name, whether it was activated online or offline, and when. An online activation also records the platform and the app version.
When computers were removed on the account page, to apply the limit of 3 removals in 30 days.
Sign-in links and sessions for the account page: each is kept as a hash, with the email address it belongs to. A link works once and lasts 15 minutes; a session lasts an hour.
Counters against abuse: how many recent requests came from an IP address (kept as it is), or used a licence key or an email address (kept only as hashes). A counter covers a window of an hour at most for IP addresses and email addresses, and a day for keys, and then expires.
Request logs: each request's IP address, time, method, path, response status and similar technical details (such as the request ID, the route and how long it took), kept for 14 days to keep the service working and safe. They are designed not to hold licence keys, email addresses or request contents. (The path of removing a computer on the account page does name the licence's internal ID and that computer's device hash.)
Paddle's event and transaction IDs, so that a purchase is never processed twice. Event records are deleted after 30 days; a transaction's record stays with its licences.

We keep licence and computer records until you ask us to delete them, because they are what makes a licence work; a refunded licence's record stays, marked as revoked. Records that expire (links, sessions, counters and event records) are deleted automatically, usually within a few days of expiring. The database also keeps backups that can restore it to any moment in the last 35 days, so a deleted record can remain in a backup for up to 35 days.

We send email through Amazon Simple Email Service: your licence keys and your sign-in links, nothing else. We send no newsletters and no marketing.

Paddle

Paddle.com is the Merchant of Record for Dawn Doc: it sells you the licence, takes your payment, works out and charges any tax, sends your receipt and handles refunds. It collects what it needs for that, such as your name, email address, country and payment details, under its own privacy notice at paddle.com/legal/privacy. Paddle tells us your email address and what you bought. We never see your card details.

Who else handles your data

Amazon Web Services hosts the licence service, its database and our email sending in its US East (N. Virginia) region in the United States, and serves this website through its CloudFront network.
Paddle, as above.
Our email provider holds what you send to support@dawndoc.com and our replies.

We don't sell or share personal information with anyone else, and we don't use it for advertising.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Deleting a licence's records ends the licence: its key can no longer activate a computer, and we can no longer email you new keys for it. Write to support@dawndoc.com from the email address on your licence. If you're not happy with our answer, you can complain to the New Zealand Privacy Commissioner (privacy.org.nz) or to the data protection authority where you live.

Changes

If we change this policy, we update this page and its date. If a change matters to how your data is used, we say so here before it takes effect.

Contact

Bit Direction Ltd, New Zealand. support@dawndoc.com