Privacy policy

Who operates LessTokens

LessTokens is a product operated by the following Taiwan company, which is responsible for the processing described in this policy:

• Gabriel Advanced Materials Co., Ltd.
• Taiwan Unified Business Number: 28822560
• 4F., No. 277-1, Sec. 4, Bade Rd., Songshan Dist., Taipei City 105056, Taiwan
• [email protected]

Information we process

We process only the information needed to provide and protect the beta service:

• Uploaded document contents, solely to perform the conversion you request.
• Job and result data, including file name, format, size, conversion status, generated Markdown, and token estimates.
• Limited technical data, such as IP address and request information, for rate limiting, security, and abuse prevention.
• Minimal first-party usage measurement events, described in the "Usage measurement" section below.
• When you sign in with Google: the stable Google-scoped account id and email asserted by Google. We do not store your OAuth password or access token in this account contact record.
• For signed-in accounts: first and latest login time, lifetime login count, each login time, and account-linked product activity. Activity records contain the feature used, time, conversion format and mode, coarse file-size range, outcome, and sealed-egg claim where applicable. They do not contain document content, Markdown, IP address, user agent or referrer.
• If you join a feature waitlist or send feedback: your email address, language preference, the feature category you selected, your consent state, and any message you choose to write.
• Information you choose to send when contacting us, such as your email address and message.

How we use information

We use this information only for the following purposes:

• To validate uploads, perform conversions, display results, and provide downloads.
• To enforce usage limits, maintain service security, diagnose failures, and prevent abuse.
• To operate signed-in account services, including account-linked history, limits, Companion ownership and support; account email may be used for essential account or service communications and future account features that are separately disclosed before launch.
• To perform internal product analysis: understand login frequency, retention, feature adoption, conversion patterns and reliability for signed-in accounts. Account-linked activity is not sold, shared for advertising or used for external marketing.
• To respond to support, privacy, legal, or rights-holder requests.
• Signing in is not consent to marketing. We will not add your account email to promotional or waitlist mailings unless you separately opt in.
• We do not use uploaded documents or conversion results to train AI models.
• We do not sell uploaded content or build advertising profiles from it.

Legal bases

Where applicable law requires a legal basis, we process data as necessary to provide the service you request, for legitimate interests in security, reliability, support, and abuse prevention, to comply with legal obligations, or with consent where we specifically ask for it.

Hosting and international processing

The beta service is hosted by Fly.io. Its active application Machine and encrypted volume are currently located in Singapore. Network routing, security, support, and infrastructure operations may involve processing in other countries under the provider's practices.

Infrastructure snapshots

Fly.io creates provider-managed volume snapshots for disaster recovery. A snapshot may contain job or result data that was active when the snapshot was taken. These snapshots are not used to serve normal requests and currently expire automatically after 5 days.

Cookies and similar technologies

LessTokens uses an essential encrypted sign-in session cookie, a functional locale cookie to remember your language choice, and your browser's local storage to remember whether this browser completed a conversion in the last 30 days (a single timestamp — no identifier). We do not use advertising trackers, third-party analytics services, tracking pixels, or cross-site tracking of any kind.

Usage measurement (first-party)

To understand whether the product works and who it reaches, we record first-party usage events on our own server. An event may include: the event type (for example page view, upload started, conversion completed or failed, result viewed, copied to clipboard, download, waitlist signup), your interface language, the country or region your request comes from, a fixed page identifier, the same kind of identifier for the page this browser first arrived through, the file format category (for example PDF or Word), the public error category if a conversion failed, whether the token count went down or up, which kind of copy you used (the Markdown itself, or the text prepared for handing to an AI), the feature category you picked if you joined a waitlist, a coarse campaign tag if you arrived through a tagged link, and whether this browser converted a document in the last 30 days (computed in your browser; only the yes/no answer is sent).

• Usage events never contain your documents, the text extracted from them, the Markdown produced from them, your file names, or your document titles. What you upload is used to perform your conversion and for nothing else, and it is deleted on the schedule described above.
• We use this measurement only to run and improve LessTokens — to see whether conversions succeed, which formats and pages matter, and which countries the service actually reaches. We do not sell it, we do not share it for advertising, and we do not use it to market to you.
• The "returning within 30 days" signal is a privacy-preserving approximation stored only in your own browser — it is not exact visitor tracking, and clearing your browser data resets it.
• Raw usage events are deleted automatically after 13 months. Waitlist and feedback entries are kept until the requested feature launches and sign-ups are notified, or until you ask us to delete yours.
• Usage data is not sold, and it is not shared with advertising networks.

Account contact retention

The provider-scoped account id and email are kept while the account is used for signed-in services, or until you ask us to delete or correct them. A later sign-in updates a changed provider email. Provider-managed disaster-recovery snapshots may retain a deleted row for up to 5 days.

Raw account activity is kept for 395 days. The account profile's first and latest login time and lifetime login count remain while the account is used, or until you request account-data deletion. Conversion-history metadata and the sealed-egg record also remain account-linked until deletion; original documents and converted content still follow the separate 60-minute deletion policy.

Service providers and disclosure

We disclose information only as needed to infrastructure providers operating the service, when you ask us to, or when reasonably necessary to comply with law, protect rights and security, or investigate abuse. We do not sell uploaded documents or personal data.

• If you choose Google OAuth sign-in, Google processes the sign-in under its own terms and privacy practices and sends LessTokens the account information described above. GitHub sign-in is not included in the account-email retention described above.

Your privacy rights

Depending on applicable law, you may request access, correction, deletion, restriction, or cessation of processing of your personal data. These rights cannot be waived where the law makes them mandatory. Contact us with enough information to identify the relevant request; we may need to verify your identity.

Documents containing other people's data

If you upload a document containing another person's personal data, you are responsible for having a lawful basis and authority to do so. During the beta, do not upload government identification numbers, account credentials, detailed medical records, children's data, or other highly sensitive data unless strictly necessary and legally authorized.

Security

We use HTTPS in transit, encrypted Fly.io volume storage, short retention, usage limits, and automatic cleanup. No online service can guarantee absolute security, so keep your own copy and avoid uploading information that is not necessary for conversion.

Children

LessTokens is not directed to children and must not be used to upload children's personal data during the beta.

Changes to this policy

We may update this policy as the service changes. The date above identifies the current version. Material changes will be presented through the service or another reasonable notice.

Privacy contact

For privacy questions or requests, contact:

[email protected]