texloom.org can’t read your work

Encrypted: what the server can’t see

The following are encrypted with AES-GCM in your browser, the desktop app or the texloom helper, using a key that only people with a link to the project have:

• the contents of every file, including images and other binary files;
• file and folder names, and the project’s name and settings;
• compiled PDFs and compile logs;
• comments, suggested changes and replies;
• the project’s history, including the names you give versions and who wrote each line;
• collaborators’ names, cursors and selections while you work together.

Files fetched back from the server are checked against their content hash, and every edit is signed, so the server can’t quietly change your work or forge edits either.

Not encrypted: what the server can see

To relay and store your changes, the server necessarily sees some information about them, though not their content:

• A project ID. A random identifier, also visible in the link before the #. It says nothing about the project.
• Sizes and times. How large each encrypted change is, when it was sent, how many people are connected to a project, and when it was last opened.
• Storage use. Which creation code (if any) a project was created with, and how much storage each code uses.
• Revoked links. The public key of a personal edit link that the owner has revoked, so that its edits can be refused. Not whose it was.
• IP addresses. Your device connects to the server, so it sees your IP address. These appear in the web server’s logs, which are kept for 14 days to deal with abuse and faults, and are used for rate limits.
• TeX Live packages. When your browser compiles a document, it downloads TeX Live packages it doesn’t already have from the server, so the server sees which packages were requested (for example tikz), but not your document.
• arXiv imports. arXiv doesn’t let browsers download a paper’s source directly, so Import → arXiv asks the server to fetch it for you. The server then sees the arXiv identifier you asked for.

None of this is sold, shared, used for advertising or profiling, or used to train anything. It is used only to run the service, keep within storage allowances and prevent abuse.

One important limit

The web app at app.texloom.org is itself served by the same server. A server operator who wanted to (or someone who broke into the server) could serve modified JavaScript that reads the key from your link. TeXLoom reduces the risk with a strict Content-Security-Policy, and all of its code is public, but you are trusting whoever runs the server you open your links on.

If that matters to you, use the desktop app or the texloom command-line helper, which run code from your own computer rather than from the server, or run your own server. The full security model is in the README.

Your links are your keys

Anyone with a project’s link can read it, and anyone with an edit link can change it. texloom.org can’t recover a lost link, because it never has the keys. Keep links somewhere safe, such as a password manager, and share them only with people you mean to. Personal edit links can be revoked; to stop someone reading as well, use Move to new keys in the Share dialog.

Stored copies, and deleting them

• Without a creation code, texloom.org keeps no copy of your project: it only relays changes between collaborators who are online at the same time. Your project lives on your devices.
• With a creation code, the server keeps an encrypted copy so that collaborators can catch up while others are offline.
• When a storage plan ends, the server’s copies of the projects created with its code are deleted 30 days later.
• A project’s owner can delete the server’s copy at any time: Settings → server storage → Don’t store anything, or ✕ on the start page.
• Stored copies of projects nobody has opened for 12 months may be removed. They are uploaded again the next time someone with an edit link opens the project.
• Encrypted backups of the server are kept for 30 days.

Copies in your browser are kept in its storage on your device, and are deleted if you remove the project from the start page or clear the site’s data. Copies in folders are ordinary files on your computer.

Donations

Donations go through GitHub Sponsors or Ko-fi, under their own privacy policies. texloom.org never sees your card or bank details. From them, we receive your name or username, the amount and the date, and on Ko-fi any message you add. A donation isn’t linked to any project or creation code. Your name appears on the supporters list only if you ask for it.

Storage plans

Storage plans are sold by Polar, our merchant of record. Polar takes the payment, works out and pays any VAT or sales tax, and sends your receipts, under Polar’s privacy policy. texloom.org never sees your card details.

From Polar, we receive your email address, your name if you give one, your country (for tax), the plan, and when it renews or ends. We use these to send you your creation code, to remind you before a plan ends, and to keep the code’s allowance and expiry date in step with your plan. We keep a note of which code belongs to which customer, so we can see how much storage your code uses and when its projects were last active. We can’t see what they contain. Your email address and name are deleted 90 days after your plan ends. The rest (the plan, its dates and the code) is kept for 6 years, for our accounts, and so that you get the same code back if you return.

Things that go to other services

• The assistant. If you use the built-in assistant, your messages and the parts of the project it reads go directly from your browser to the provider you chose (Anthropic, OpenAI, OpenRouter, or a model on your own computer), with your API key. Their privacy policies apply. texloom.org is not involved and never sees your key.
• + Reference. Looking up a DOI or arXiv id sends that identifier from your browser to doi.org.
• Email… in the Share dialog opens your own email app. The link travels in that email, not through texloom.org.
• This website’s download buttons ask GitHub’s API for the latest release, and downloads come from GitHub, so GitHub sees your IP address when you use them.

This website

texloom.org (this site, not the app) sets no cookies, runs no analytics and loads nothing from other sites apart from the GitHub release information above. Its web server keeps no access logs. The page remembers the latest release for half an hour in your browser’s session storage, so it doesn’t ask GitHub again on every page.

Your rights, and contact

TeXLoom at texloom.org is run by its maintainer, an individual developer in the UK, who is responsible for the information described above. You can ask what we hold about you (in practice: donation and storage-plan records, and recent logs), ask for it to be corrected or deleted, or object to how it is used, by emailing privacy@texloom.org. Because we can’t decrypt projects, we can’t search them for you or hand their contents to anyone else, including if asked to. If you’re in the UK or the EU you also have the right to complain to a data-protection authority (in the UK, the ICO).

If this policy changes, the date at the top will change, and significant changes will be noted in the changelog.