Privacy Policy

cDox is built around a simple idea: your pages are yours. We're not a data company, an advertising company, or an AI company. We're just people trying to build a calm, trustworthy place to write and share pages. This policy explains, in plain language, what we do and don't do with your data. cDox is made by BFH Labs, Inc., a Canadian federal corporation based in Victoria, British Columbia. In this policy, "we" and "us" mean BFH Labs.

Where your data lives

All cDox data is stored and processed in Canada on independently owned, Canadian bare metal servers located in Montreal. Your data stays in Canada and is governed by Canadian law. Nightly backups are kept in Toronto for 14 days, so your content does not leave Canada as part of normal operation or backups. The one exception is product analytics: usage events (which features are used, tied to an account number, never your content) are processed by PostHog in the United States.

What data we collect

We collect only what's required to run the service:

• Account information, such as your email address or phone number
• Pages and content you choose to create or upload
• Basic operational logs needed to keep the service reliable and secure

We do not collect advertising identifiers or unnecessary personal information. Inside the app we count which features are used, tied to an account number and never to your content, so we know what to improve. We're not interested in profiling you or watching how you work.

How we use your data

Your data is used solely to provide and operate cDox. That's it.

We do not read your pages unless you explicitly ask for help and give us permission to look at something specific to provide support. Your content is never used for AI training, machine learning, analytics experiments, or any secondary purpose.

AI and training

To be very clear: your writing is never used to train AI systems. Not now, not later, not in anonymized form, and not as part of "research." We don't do that.

Third parties

We do not sell, rent, or trade your data.

We use a small number of service providers: FullHost for our servers and backups (Montreal and Toronto), Resend for email, Fathom for anonymous website visits, and PostHog for product usage. Our hosting provider holds the data we store. Resend sees email addresses and, when you share something, its title. None of the others see your page contents. Every provider is listed, with what it sees and where, on our Trust page at cdox.studio/trust.

Payments are processed by Helcim (web), Apple (in-app purchases on iOS) or Google (in-app purchases on Android). We never see or store your card details ourselves.

Security

We take reasonable technical and organizational steps to protect your data, including encryption in transit (HTTPS), hashed passwords and access to our servers limited to one person. Your content is not encrypted at rest, which is what lets search, sharing and public links work. No system is perfect, but we design cDox to minimize risk and unnecessary exposure.

Data retention and deletion

You can delete pages or your entire account at any time. When you do, your data is removed from our live systems right away and from our nightly backups as they expire, within 14 days. We do not keep hidden copies, and we do not retain deleted content for AI training, analytics, or secondary use. Temporary retention may occur only where required for security, legal, or operational integrity.

Changes to this policy

If we make changes to this policy, we'll update this page and revise the effective date. We won't materially change how your data is handled without notice.

Questions

If you have questions about this policy or how your data is handled, please use the contact form linked in the footer, or the help page when you're logged in. BFH Labs, Inc. is responsible for the personal information described in this policy and is subject to Canadian law.

We're not lawyers, and we're not trying to hide behind legal language. If something here feels unclear, reach out. We believe transparency works best when people can actually understand it.