Privacy Policy

Last updated: 15 September 2026

Contents

Overview

Save My Tokens ("we", "our", "us"), operated by PM Project Change Pty Ltd, converts documents to markdown. This policy explains what we collect, what we do with it, and what we deliberately never collect, when you use savemytokens.app.

Who we are

Legal entity: PM Project Change Pty Ltd

ABN: 83 692 182 479

Location: Sydney, NSW, Australia

Contact: [email protected]

Your files

WE DO NOT STORE YOUR FILES. The file you upload is held in your browser's request, converted in our server's memory, and the markdown is returned to you in the same response. It is never written to disk, a database, a log, a backup, or sent to any third party. When the response is sent, no copy exists anywhere on our side.

We do not read, review or analyse the content of your files beyond what the conversion engine does mechanically. We do not use your files to train anything.

Information we collect

If you pay

  • Email address from Stripe checkout, to link your subscription to you and send your access code
  • Name, if you enter one at checkout
  • Purchase record from Stripe: amount, currency, discount, date, billing country, and Stripe's session and subscription identifiers. Never your card details.

Everyone

  • A conversion count and a random visitor identifier in a signed browser cookie, so the free tier works and we can count unique free users without relying on IP addresses
  • Usage records: each conversion, paywall hit and login is logged with a timestamp, event type, file type and size, page and token counts, your IP address, and either the visitor identifier (free) or your email (Pro). Never the file, its name, or its output.
  • Technical information: IP address, browser type, page requested, upload size, timestamps, in standard server logs for security and capacity planning
  • Usage analytics, if enabled, via Google Analytics or Cloudflare Web Analytics (pages visited, buttons clicked). Never file contents.
  • Font requests: the site's typeface is served by Google Fonts, so Google receives your IP address and browser details when the font loads. No cookie is set.
WE DO NOT COLLECT:
  • The content of your files or the markdown we return
  • File names, beyond the request that converts them
  • Card or bank details (Stripe handles payment; we never see them)
  • Government identifiers
  • Your address, unless you give it to Stripe for tax purposes

How we use your information

  • Provide the service: convert your file and return it
  • Manage access: confirm your subscription and send your access code
  • Transactional email: receipts, access codes, renewal notices, changes to terms. Delivered by Resend.
  • Security: rate limiting, abuse and fraud prevention
  • Improve the service: aggregate usage patterns, never file contents
  • Legal compliance
We do NOT: sell your data, share your files with anyone, use your data for third-party advertising, or train AI models on anything you upload.

Payment processing

Subscriptions are purchased through Stripe. Stripe collects and processes your payment details in its own secure checkout. We never receive or store card numbers. Stripe shares with us only what is needed to confirm your purchase and link it to your email address. Stripe's handling of your data is governed by Stripe's privacy policy.

Storage and security

Where data lives

  • Application hosting: Railway (United States). Files pass through memory only.
  • Purchase and usage records: Stripe, and a Supabase database hosted in Sydney, Australia
  • Transactional email: Resend (United States)
  • DNS and DDoS protection: Cloudflare

Security measures

  • HTTPS for all traffic
  • No file storage, so there is no file store to breach
  • Signed, HTTP-only, same-site cookies
  • Rate limits on conversions and access-code entry
  • Security headers (CSP, HSTS, frame denial)
NO SYSTEM IS 100% SECURE. We cannot guarantee absolute protection against every threat. Keep your own copies of anything you upload; we never hold one.

Retention

  • Your files and output: not retained. Zero seconds after the response is sent.
  • Conversion count cookie: up to 12 months in your browser. Clear it any time.
  • Server logs: a limited rolling period, then deleted
  • Usage records (timestamp, event type, file type and size, token counts, visitor identifier or subscriber email): about 13 months, so we can enforce the monthly limit and see how the service is used. The IP address on each record is removed automatically after 90 days.
  • Purchase records and email: while your subscription is active and for the period required by Australian tax law afterwards

Your rights (Australian Privacy Principles)

Under the Privacy Act 1988 (Cth) you may:

  • Access the personal information we hold about you (APP 12)
  • Correct it (APP 13)
  • Request deletion of your account information, subject to records we must keep by law
  • Complain to us (we respond within 30 days) and, if unsatisfied, to the Office of the Australian Information Commissioner

Email [email protected] to exercise any of these.

International users (GDPR)

If you are in the EEA or UK, our legal bases are contract performance (providing the service you paid for), legitimate interests (security, fraud prevention, improvement) and, for analytics cookies, consent. You have the rights to access, rectification, erasure, portability, restriction and objection, and to complain to your local supervisory authority. Your data may be processed in Australia and the United States, where our providers are located, under appropriate safeguards.

Cookies

Essential

  • Session cookie: holds your free conversion count, a random visitor identifier and, if you have paid, your unlocked status and email. Signed and HTTP-only. Required for the service to work.
  • Cloudflare: security and bot protection

Optional

  • Google Analytics, if enabled, to understand which pages and features are used. Disable it in your browser or with a blocker; the service works without it. Cloudflare Web Analytics, if enabled instead, sets no cookie.

Third parties

WE DO NOT SELL YOUR DATA. No third party ever receives your files.

Children

The service is for adults (18+). We do not knowingly collect information from anyone under 18. If you believe we have, email [email protected] and we will delete it.

Changes to this policy

We may update this policy. Paid users get an email, and the date at the top changes, at least 7 days before a significant change. Continued use after a change takes effect is acceptance.

Contact

Privacy enquiries: [email protected]. We respond within 30 days.

Breach notification: if a breach affects your personal information we will notify you as required by Australian law, typically within 72 hours of becoming aware.

Escalation: Office of the Australian Information Commissioner, www.oaic.gov.au, 1300 363 992.

← Back to Save My Tokens · Terms of Service →