Last updated: July 28, 2026
ilovehtml stores HTML pages you upload and gives you links to share them. We collect the minimum needed to run that: your account details, the files you upload, and some technical records needed for security. We don't sell your data, we don't show ads, and we don't use the content of your files to train AI models.
Analytics about who opens a shared link is anonymous and aggregate by default — no IP addresses, no cross-site profile. The one exception is that a customer can switch on a screen asking a visitor for their email before a document opens; when that happens the visitor is told, on that screen, exactly who receives it. See “When a document asks for a visitor's email”.
Files belong to an organization— a library. On a personal account that library is just you. If you join a company's library, its owner and admins can see and manage everything in it, including what you publish there. Details below.
Your name, email address, and profile photo. If you sign in with Google, we receive your name, email, and profile photo URL from Google — never your Google password. If you sign in with a password instead, we store only a bcrypt hash of it, never the password itself.
We also store the permanent name you choose during onboarding, because it becomes part of every share link created in that library. If you invite colleagues, we store their email address on the pending invitation until it is accepted, expires, or is revoked — and a hash of the invitation link, never the link itself.
Each page records who published it. That name is visible to the other members of the same organization, and to nobody outside it. It is never shown to visitors of a share link.
The HTML files you upload and their file names, the folders you organize them into, the tags you create, and each item's sharing setting. When you protect a share link with a password, we store a hash of that password, not the password.
When someone opens one of your share links, we record the event so you can see how your page is doing: the time, which file, the country the request came from, the hostof the referring site (“google.com”, never the full URL they came from), and a coarse device, browser and operating system.
We do notstore visitors' IP addresses. To count the same person once a day without identifying them, we derive a one-way identifier from their address, browser and the account being visited, salted with a secret that changes every day. It can't be reversed to an IP, can't be used to follow anyone across days, and can't be matched between two different customers' statistics. These records are deleted after 180 days.
We also record how long the document was open. This is measured by our own viewer, and only while the tab is actually in front of the visitor — a page left open in a background tab does not accumulate time.
Everything above is deliberately anonymous and aggregate. One feature is not, so it is described plainly rather than buried: our customers can turn on a screen that asks for your email address before a document opens. It is off by default and switched on per document, never account-wide.
That screen names the organization receiving the address before you type it. If you enter one, we store the address, when you first and last opened that document, and how many times — and the organization that sent you the link can see all of it, including how long you spent reading. We store no name, no company, and nothing inferred or bought from anywhere else, and we never use these addresses ourselves: not for our own marketing, not for building a profile across customers, not for training anything.
If a document accepts comments, whatever you write is stored with the address you signed it with and emailed to the person who shared the document.
You gave the address to that organization, so they hold it: ask them to erase it and they can, from the document's own records. If you can't reach them, write to us at [email protected] and we will.
Timestamped counts of sensitive actions — sign-in attempts, share-password attempts, API calls — keyed by email address, account, or IP address, so we can rate-limit abuse. These are short-lived and used for nothing else.
We also store hashed API keys and hashed OAuth tokens (see “Connected apps” below), plus the standard session cookie that keeps you signed in.
Every file and folder belongs to exactly one organization— the library behind your account name. If you signed up on your own, that organization is just you. If you were invited into a company's library, it is that company's.
Other organizations cannot see, list, or open your files. This is enforced on the server, not hidden in the interface: asking for a file that belongs to another organization returns the same “not found” response as a file that doesn't exist.
Inside an organization, the content is shared. Its owner and admins can open, edit and delete everything in it, including pages you published — and they can see who published each one. Editors can publish and edit; viewers can only look. If you publish something to a company's library, treat it as the company's, not yours: that is what a shared drive means, and it does not change when you leave.
That is the only sharing that happens. ilovehtml staff and platform administrators have no access to your files. The platform admin role manages accounts — approving sign-ups, setting plans and limits — and that is all it can do. It grants no route to anyone's content.
Beyond your organization, your files can be reached only by:
To be precise about the limits of that promise: our hosting and database providers hold the data on their systems, and restoring the service after a serious failure could require working with stored data directly. What we've removed is the ability to browse or open your files through the product.
You can connect outside applications — like Claude or ChatGPT — to your account so they can read and update your files on your behalf. There are two ways to do that, and both are limited to your own account:
Every app you've authorized is listed under Account settings → Connected apps, and disconnecting one revokes its access immediately.
What a connected app does with your data once it receives it is governed by that app's own privacy policy, not this one.
We run on third-party infrastructure and share data with these providers only as needed to operate the service:
These providers process data on our behalf. We do not sell personal data, and we do not share it with advertisers or data brokers.
A customer can attach their own Meta Pixel or Google Analytics tag to one of their files. When they do, opening that page also sends data to that provider — and the customer, not us, decides that and answers for it. If they enable Meta's Conversions API, our server additionally reports the visit to Meta, including the visitor's IP address and browser user agent, using credentials belonging solely to that customer.
Two limits are worth stating plainly. A tag runs inside the isolated frame that holds that one page, so it cannot read this app's cookies, act on behalf of anyone signed in, or observe any other customer's content. And customers supply an ID, never code — we build the tag ourselves from a validated identifier, so nobody can use this to run arbitrary scripts on a page we serve.
Pages with no pixel configured send nothing to anyone. We run no analytics or advertising tags of our own on shared pages.
We use cookies only to make the product work: one to keep you signed in, and short-lived ones to remember that you already entered the password for a protected share link. There are no advertising or third-party tracking cookies.
We keep your account and its libraries for as long as your account exists. You can delete individual files and folders at any time; deleting a file removes its stored contents and breaks its share link.
Visitor email addresses and comments belong to the organization whose document collected them, and are erased with that organization. An individual address can be erased on request at any time, from the document's own records, without waiting for anything else.
You can delete your whole account from Account settings. Deletion is scheduled 30 days out, and signing back in during that window cancels it.
When it goes through, every library where you are the only member is erased completely: your login, sessions, linked Google account, API keys, connected apps, tags, analytics records, saved reports, pixel settings — and the files and folders in it, including their stored contents and the share links pointing at them. Nothing is kept under a different owner, and nothing is retained for staff to look at. It can't be undone, so download anything you want to keep before the 30 days are up.
A library shared with other people is not deleted with your account. Your access to it ends, and pages you published there stay with the organization — no longer attributed to you once your account is gone. If you were its only owner, the longest-standing remaining member becomes the owner. Deleting a company's work because one person closed their account is not something we are willing to do; an owner who wants the whole library gone can delete the organization itself, from its Members page, which erases everything in it for everyone.
Being removed from an organization works the same way, immediately rather than after 30 days: you lose access on your next request, and what you published stays.
You can view and change your name, email, photo, and password at any time from Account settings, export content by downloading your files, revoke any API key or connected app, and delete your account. If you'd like a copy of the personal data we hold about you, or want it corrected or erased, email us at the address below and we'll take care of it.
Depending on where you live you may have additional rights over your personal data. We honor those requests regardless of where you are.
Passwords are stored as bcrypt hashes; API keys and OAuth tokens as SHA-256 hashes. Uploaded HTML is rendered inside a sandboxed frame so one customer's page cannot read another customer's session. Sign-in and share-password attempts are rate-limited. No system is perfectly secure, but we treat isolation between organizations as the thing we must never get wrong.
ilovehtml isn't intended for children under 13, and we don't knowingly collect their personal information. If you believe a child has given us personal data, email us and we'll delete it.
If we change how we handle your data in a way that matters, we'll update this page and move the “last updated” date. Significant changes will also be announced by email or in the app.
Questions about privacy, or a request about your data? Email [email protected].