Privacy Policy
Last updated 27 August 2026
This explains what Octopus collects, why, and who we share it with. Octopus is a document-sharing and analytics service, so it necessarily handles some data about both senders and the people who open shared documents.
1. What we collect
Account data: your email address (and login credentials, stored securely by our authentication provider).
Documents: the files you upload and their metadata (name, page count).
Viewer data: when someone opens a shared link, we record the email they provide (if the link asks for one), their IP address and browser, and page-by-page reading activity (which pages, and how long). This is the analytics the sender sees.
Billing data: if you subscribe to a paid plan, our payment processor (Polar) collects and handles your payment details. We receive your subscription status, plan, and renewal date, not your full card number.
Cookies: a login session cookie for signed-in users, and short-lived cookies on shared links to remember that a viewer passed the gate.
2. How we use it
To provide the service: store and display documents, enforce access controls, and show senders analytics about their own documents.
To send notifications you turn on (for example, an email when someone opens your document) and verification codes for email-gated links.
3. Who we share it with (processors)
We use a small set of infrastructure providers who process data on our behalf: Supabase (database and authentication), Cloudflare R2 (document storage), Resend (transactional email), Polar (payment processing for paid subscriptions), and Vercel (hosting).
We don't sell your data or share it for advertising.
4. Security
Each account can only access its own data (enforced at the database level). Documents are stored privately and served through access-checked, short-lived links, never public bucket URLs. Passcodes are hashed, not stored in plain text.
5. Data retention
We keep your documents and analytics for as long as your account is active. You can delete a document or turn off a link at any time; deleting a document removes its stored file and analytics.
6. Your rights
You can request access to, correction of, or deletion of your personal data. If you're a document viewer and want your captured email or reading data removed, contact the sender or email us and we'll help.
7. Children
Octopus isn't intended for anyone under 16, and we don't knowingly collect their data.
8. Changes and contact
We may update this policy; we'll change the date above when we do.
Privacy questions or requests: privacy@talkoctopus.com.