Privacy policy

Last updated 16 October 2026

A1 Office is built so that most of what you do never leaves your device. This policy explains what we handle when you use the site, what we keep, who else is involved, and the choices you have.

Files you open in the tools

PDF, image and document tools (such as compress, merge, split, convert, OCR and fill and sign) run inside your browser. Your files are not uploaded to our servers.

The OCR tool downloads language data from jsDelivr, a public content network, the first time you use a language. Like any web request, that service sees your IP address. It does not receive your files.

AI features

When you use an AI feature (the presentation maker, document writer, chat with a document, summarise, translate, the agent, or a request typed into the home box), the text you type and the relevant text from your document are sent through our server to OpenRouter, which passes them to the AI model chosen to answer. Images in your documents are not sent.

We keep your requests for 90 days so you can reuse them; delete them any time in your account. A request is the text you typed and the names of the files you attached, never the files or the answer. We do not otherwise store your prompts or the answers on our servers, unless you turn on Help improve AI answers on the Account screen. Then, while you are signed in, we keep the prompt and the answer of each AI request, and any rating you give it, for 30 days so we can review the quality of answers; turning it off or deleting your account deletes them. For each request we log the model used, the number of tokens and the cost, without its content, so we can manage costs.

OpenRouter and the model providers process this text under their own terms and privacy policies. We do not use your content to train AI models.

Accounts, Sign in with Google and Sign in with Apple

Signing in is optional. If you sign in with Google, we ask Google only for your basic profile (scopes: openid, email, profile). We receive and store your Google account ID, email address, name and profile picture link. We never see your Google password, and we do not keep Google access tokens after sign-in.

If you sign in with Apple, we receive and store your Apple account ID, the email address Apple shares with us (which can be a private relay address if you choose to hide yours) and, the first time, your name. We never see your Apple ID password.

When you are signed in, the documents and presentations you save to your account are stored with their title and dates, so you can open them on other devices. Each save and each tool you use also records which of your devices it happened on, as a random device id and a name such as "iPhone" or "Mac", so we can show "Pick up where you left off" and "edited on your iPhone".

A1 Office's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this information only to sign you in and show your account, and we do not sell it, use it for advertising, or share it except as described in this policy.

Cookies and storage on your device

If you sign in, we set a session cookie that keeps you signed in for up to 30 days, and a short-lived cookie during the sign-in step to protect it. Both are strictly necessary.

The site uses your browser's local storage to keep drafts, settings such as light or dark mode, and similar preferences on your device. You can clear these at any time in your browser settings.

We use Google Analytics for Firebase to count how the site is used: screens opened, tools and templates used, how many files, how large and of what type, AI features used, how long AI answers take and how you rate them, and device type, linked to your account id if you are signed in. It never receives your documents, file names, AI prompts or email address. In the European Economic Area, the United Kingdom and Switzerland we ask before turning it on; elsewhere it is on unless you turn it off. You can turn it off or on at any time with Share usage statistics on the Account screen.

With the same permission, the website also uses Yandex Metrica to count page visits, clicks on links and buttons, and how long pages stay open. It receives page addresses with file ids, share links and search terms removed, and never your documents, file names, AI prompts or email address. It also records how pages are scrolled and clicked (session replay), but with your files, documents, prompts and account details blanked out and nothing you type recorded. Saying no on the Account screen stops it straight away.

With the same permission, the website also uses Microsoft Clarity to record how pages are scrolled and clicked (session replay) and to draw heatmaps of where people click. Your files, documents, prompts and account details are masked in those recordings and nothing you type is recorded. Clarity receives page addresses, your browser type and a hashed (scrambled) account id if you are signed in, never your documents, file names, AI prompts or email address. The link to each recording is also shared with Google Analytics and Yandex Metrica so a recording can be matched to the visit it shows. Saying no on the Account screen stops it straight away.

With the same permission, the website also uses the Meta Pixel and Meta's Conversions API to measure our ads on Facebook and Instagram: page visits, sign-up, your first few AI requests, your first download, claiming the daily credits, tapping Upgrade or a plan, and buying a plan, with its price. Meta receives page addresses with file ids and searches removed, your browser and IP address, Meta's own cookies, and your account id and email address in hashed (scrambled) form so it can match the visit to a Meta account. It never receives your documents, file names or AI prompts. Saying no on the Account screen stops it straight away.

The iOS and Android apps

The apps run the same A1 Office as the website and handle data the same way. When you sign in, the app keeps its sign-in token in your device's secure storage (the iOS Keychain or the Android Keystore). Files you save or share from the app pass through the app's temporary storage on your device to the share sheet; we do not receive them.

The apps do not track you across other companies' apps or websites, show ads, or collect usage statistics at this time. We will update this policy before that changes.

Hosting, security and logs

The site is hosted on Cloudflare, which handles every request and may process IP addresses and request details to deliver the site and protect it from attacks. Saved account data is stored in Cloudflare's database service.

We use your IP address briefly, in memory, to limit how many requests can be made in a short time. It is not stored for this purpose.

How we use information

We use the information above only to provide the features you ask for, keep your account and files available to you, keep the service secure, prevent abuse, and manage our costs. We do not sell personal data and we do not show ads.

Who else processes data

Cloudflare (hosting, database and security), OpenRouter and the AI model providers it routes to (AI features), Google (sign-in, and usage statistics if you allow them), Yandex (website usage statistics, if you allow them), Microsoft (session recordings and heatmaps, if you allow usage statistics), Meta (ad measurement, if you allow usage statistics), Apple (sign-in), and jsDelivr (OCR language data). These providers may process data in the United States and other countries.

How long we keep data

Account details and saved files stay until you delete them or delete your account. Sessions end when you sign out or after 30 days without use.

When you delete a file or your account, it is removed from our database straight away. Copies may remain in our hosting provider's database backups for up to 30 days before they are overwritten.

Your choices and rights

You can use every tool without an account. When signed in, you can rename or delete any saved file from Recent files, and delete your account and all its files from the Account screen (or the account menu on the website).

Depending on where you live (for example the UK, the European Union or India), you may have rights to access, correct, delete or move your personal data, and to object to or restrict how it is used. Contact us to use these rights. You can also complain to your local data protection authority.

You can remove the site's access to your Google account at any time from your Google Account settings, under third-party connections, and stop using Sign in with Apple from your Apple ID settings, under Sign in with Apple.

Children

A1 Office is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

If we change how we handle data, we will update this page and the date at the top. For significant changes affecting account holders, we will also show a notice on the site.

Contact

Email [email protected] with any question about this document or your data. We aim to reply within 30 days.