Privacy

Last updated October 22, 2026

AttachPage lets you publish a web page or document and share it: with specific people through personal links, through secret links you hand out yourself, or with anyone who has the page's address. You can also publish a page just for yourself. AttachPage is run by JP Technology Services LLC in Virginia, USA. This page explains what we store, why, who helps us run the service, and what you can ask us to do.

What we store

• Your account. Your email address and name from Google or Microsoft sign-in, and the account identifier they give us. We never see your password.
• Your pages. The files you publish, each page's name and address, recent versions (so you can restore one), and the messages you write when you send a page.
• People you send pages to. Their email addresses, when they first and last opened the page and how many times, and any comments, approvals or change requests they leave. We do not record their IP address, device or location. If you ask for an email code, we email them a one-time code before the page opens; we keep only a one-way hash of it.
• People you let suggest changes or edit. They sign in with the address you sent the page to. We keep their unpublished changes, the changes they suggest (with their email address) and what you decided, and which of them published each version.
• Secret links. The name you give a link, when it expires, and when it was first and last used and how many times. We do not know who used it: visitors give no email address, and their comments and approvals are shown to you as "Secret link visitor".
• Pages published without an account. These are public. We keep the publisher's IP address to limit abuse (no more than 10 such pages per network per day), and the page is deleted after 48 hours unless someone signs in and keeps it with the claim link.
• Agent connections. The names of API keys and connected AI apps (for example Claude or ChatGPT) and when they were last used. Keys and access tokens are stored only as one-way hashes.
• Security records. A log of important actions (sign-ins, publishing, sends, revocations) without IP addresses. IP addresses are used where we need them to limit abuse: request rate limits (kept for about a minute), pages published without an account, abuse reports, and sign-in requests started from an AI chat.
• Emails we send. A record of each email (recipient, subject and the details in it), kept for 90 days so we can deliver it and investigate problems.

What stays in your browser

When you drop or paste files, the checks and the instant preview run in your browser. Nothing is uploaded until you choose to publish.

How we use it

• To host your pages and show them only to the people you choose.
• To send the emails you ask for (invitations and update notices) and the notices you expect (someone opened your page or left feedback, or a new AI app was connected to your account).
• To keep the service safe: limits, abuse reports and screening (below).

Abuse screening and AI

• Automated checks run when you publish, for example blocking password fields, secret keys and executable files.
• Once a day, newly published pages are screened for phishing and other abuse by rules and by an AI model that runs inside Cloudflare (Workers AI). The model sees a page's name and up to 3,500 characters of its visible text. Our admins get a daily summary with page names, public addresses, new account emails and anything flagged. The checks only flag pages; a person decides what happens.
• We do not use your content to train AI models, and we do not send it to other AI companies. When you connect an AI app such as Claude or ChatGPT, that app can use your account as you approved on the consent screen, and its provider's terms apply to what it does with that access.

What we do not do

• No ads, and we do not sell or rent your data.
• No analytics or tracking scripts on your pages or ours. We do not change your pages, except that people you invited, or who opened a secret link, see a small feedback button when you allow comments.
• We do not browse your pages unless a check or an abuse report flags one.

Cookies

Only the ones needed to work, never for advertising or analytics:

• a sign-in cookie on AttachPage while you are signed in (up to 30 days);
• a viewing cookie on each page address, so an invited person or secret-link visitor stays signed in to that page (12 hours);
• a review cookie that lets an invited person or secret-link visitor approve or request changes (12 hours).

Who helps us run AttachPage

• Cloudflare hosts the service and stores pages and data. It also sends our emails, runs the AI model used for abuse screening, converts Word and PowerPoint files, and makes preview images of public pages for link previews.
• Google (Identity Platform) handles sign-in, and Microsoft does too if you sign in with a Microsoft account. Our support inbox is on Google Workspace.

Data is processed in the United States and in Cloudflare's network.

How long we keep things

• Pages stay until you delete them. Deleting a page takes it offline at once and its files are removed within a day. Each page keeps its 10 most recent versions; older ones are removed after 7 days.
• Pages published without an account are deleted after 48 hours unless claimed.
• Personal and secret links work for as long as the sender chose (from 1 day to no end date). The sender can end access, or revoke a secret link, at any time.
• Email records: 90 days. Expired sign-in links, sessions and one-time codes: 30 days.
• If you ask us to delete your account, we delete your pages and account data within 30 days, except records we must keep for legal reasons or to prevent abuse.

If someone sent you a page

The sender decided to share it with you and controls it. We store your email address and your opens, comments and decisions so the sender can see them. If you opened it with a secret link, we store no email address for you, only when the link was used and what you chose to write. Ask the sender, or us, if you want them removed.

Your choices

You can download or delete your pages, remove recipients, end access, and disconnect AI apps at any time from your dashboard. To get a copy of your data, correct it, or delete your account, email support@attachpage.com. AttachPage is not meant for children under 13.

Changes and contact

If this policy changes, we update this page and the date above. Questions: support@attachpage.com. Reporting a harmful page: report it here. How we protect your data: Trust center.