Privacy Policy
Last updated: 20 October 2026
myDocs.cloud ("myDocs", "we", "us") is a vault for your personal documents with expiry reminders. This policy explains what data we keep, why, who else receives it, how long we keep it and how you can delete it. It covers the website mydocs.cloud, the web app at app.mydocs.cloud and the myDocs app for iPhone and iPad.
We do not sell your data, we do not show ads, and we do not use analytics or tracking tools.
1. Data you give us
Account
- Your email address, an optional name and your preferred language.
- Your password, stored only as an Argon2id hash. We cannot see it.
- If you sign in with Google or Apple: the account identifier and email address the provider shares with us. With Apple's "Hide My Email" we only receive the relay address.
- If you add a passkey (Face ID, Touch ID or a security key): its public key and the name of the device. Your biometric data never leaves your device.
Documents
- What you enter about a document (name, type, number, issued by, country, dates, notes, reminders, tags, folder) and the files you attach, with the thumbnails and previews made from them.
- Text recognised in your files. Recognition runs on your device; we only store the resulting text.
2. How your documents are protected
- All connections use HTTPS.
- Encrypted documents are encrypted on your device with a key only you hold (your password, secret key, master key or passkey unlocks it). Their files, number, "issued by", notes and recognised text reach our servers already encrypted, and we cannot read them. The name, type, country, dates, tags and folder of such a document stay readable by our servers so that lists, search and expiry reminders work.
- Other documents: their number, "issued by", notes and recognised text are encrypted on our servers with our key; their files are stored as they are.
- We store only encrypted copies of your encryption keys. Without your password, secret key, master key or passkey they cannot be opened, also not by us.
3. Data created when you use myDocs
- Sessions. For every signed-in device we keep the IP address, a short device description taken from the browser or app (for example "Safari on iOS"), and when it signed in and was last used. You can see and sign out sessions in Settings → Security.
- New-device alerts. Your browser keeps a random identifier so we can tell a new device from a known one. When an account is used on a new device, we send you an email with the device, the time, the IP address and its approximate location (country and city), and a push notification if you enabled it.
- Shared links. When you share a document, we keep the link settings; a PIN is stored only as a hash. If you asked to be told when the link is opened, we email you the IP address, approximate location and device of whoever opened it. People who open your links should be aware of this.
- Push notifications. If you turn them on, we keep the push address your browser or device gives us. Notifications for encrypted documents contain only the document name and dates.
- Offline copies. If you turn on offline access, your documents are kept on that device. Encrypted documents stay encrypted there. Turning offline access off or signing out removes them.
4. Who else receives data
We only use the services below to run myDocs, and only with the data each one needs.
| Service | What for | Data |
|---|---|---|
| Amazon Web Services (Amazon SES) | Sending emails: confirmation, password, reminders, alerts | Your email address and the email content. The service records delivery and may record whether an email was opened or a link in it was clicked. |
| Google (Firebase Authentication) | "Sign in with Google" and "Sign in with Apple" on the web | The sign-in exchange with your Google or Apple account |
| Google (Google Drive) | Optional backups to your own Google Drive, see section 5 | Your backup archive |
| Google Fonts | Fonts on our pages | Your IP address, as for any web request |
| Apple | Sign in with Apple, notifications in the iPhone and iPad app | The sign-in exchange with your Apple account, notification content |
| ipstack (apilayer, USA) | Approximate location in new-device and link-opened emails | The IP address only. We keep the answer (country and city) for 30 days so the same address is not looked up again. |
| Push services of your browser (Apple, Google, Mozilla, Microsoft) | Delivering push notifications | The notification, encrypted end to end so the push service cannot read it |
We may also disclose data when the law requires it.
5. Backups to Google Drive
You can connect your own Google Drive in Settings → Backup. Then, every night when something changed, and whenever you press "Create new backup", myDocs saves a backup archive to a "myDocs Backups" folder in your Drive and removes the previous one. We do not keep backups on our servers.
- We ask Google only for access to files that myDocs itself creates (the
drive.filepermission). myDocs cannot see or open any other file in your Drive. - We store the Google account email shown in Settings, an encrypted token that lets us save the backup, and the identifier and size of the backup file.
- We use this access only to save, replace, download and restore your backups when you or the nightly schedule ask for it. No person at myDocs reads your Drive files, and the data is not used for anything else.
- Encrypted documents stay encrypted in the archive. Other documents and their files can be read by anyone who has access to your Google account.
- Disconnecting Google Drive, or deleting your account, revokes our access at Google. The last backup stays in your Drive. You can also remove access at any time in your Google account settings.
myDocs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Cookies and storage in your browser
- One cookie, needed to keep you signed in. It cannot be read by scripts and is not used for tracking.
- Your browser's local storage keeps your settings, the random device identifier from section 3 and, if you turn on offline access, your saved documents.
- We use no advertising or tracking cookies, and we honour "Do Not Track".
7. How long we keep data
- Your account and documents: until you delete them.
- Deleted documents: kept for 30 days, so they can be restored from a backup, then removed. Replaced files are kept for 30 days as well.
- Sessions: removed 30 days after they end. Device identifiers: removed after 180 days without use.
- Location lookups: 30 days.
- Backups made on our servers before October 2026: deleted on 20 November 2026.
- Deleted accounts: sign-in stops at once; the account, its documents and files are removed after 30 days. Access we were given to your Google Drive and your Apple account is revoked when you delete the account.
8. Your choices and rights
- See and change your data in the app at any time.
- Take your data with you: "Export as ZIP" in Settings → Backup, or a backup to your Google Drive.
- Delete documents, or your whole account in Settings → Danger zone.
- Unsubscribe from reminder and link-opened emails with the link in them, and turn push notifications off in Settings. Security emails (such as new-device alerts) are always sent.
- For any other request about your data, write to us (section 11).
9. Children
myDocs is not meant for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Security incidents
If a security incident affects your data, we will tell you by email without undue delay.
11. Contact
Questions about this policy or your data: vitally@awery.aero
Dubai, UAE
When this policy changes, we update the date at the top of this page.