1. Who we are

LetX is a collaborative LaTeX editing platform operated by Shahriar Labs, based in Dhaka, Bangladesh ("LetX", "we", "our", or "us"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have. It applies to letx.app and related services.

2. Information we collect

Information you provide:

Account: name, email address, and (for email sign-up) a hashed password. If you sign in with Google or GitHub, we receive your name, email, and avatar from that provider.
Profile & onboarding: to tailor the product and understand our users, we ask for your role, field, university or company, and how you write, and optionally your title, a work/portfolio link, gender, and how you heard about us. You can edit or clear these in settings.
Your content: the LaTeX documents, files, images, and project data you create, upload, or collaborate on.
Communications: messages, feedback, and support requests you send us.

Information collected automatically:

Usage & device data: IP address, approximate location derived from IP, browser and device type, pages viewed, and actions taken.
Cookies: a small number of strictly-necessary cookies for authentication (including an HttpOnly session cookie) and preferences. See §7.

Proof of academic status: if you apply for academic pricing, you send us a document showing your name and your institution, usually a student or staff ID card, and the name, institution, role and country you type on the form. We use it for one purpose: deciding whether you qualify for the discounted price. It is stored privately, is never published or served from a public address, and is deleted within about a day of the decision. What we keep afterwards is the decision itself, the reason we gave you, and the notes from the check, not the document. You are welcome to black out anything on it that is not your name, photo, institution and dates. An automated first check reads the document to compare it against what you told us; that check is never asked to judge whether a document is genuine, and anything it cannot settle goes to a person.

Payments: paid plans are sold through Lemon Squeezy, LLC, our merchant of record. Your card details are entered on their checkout and handled entirely by them, we never receive or store full card numbers. We do receive, and store, the information we need to run your subscription: your Lemon Squeezy customer and subscription identifiers, the plan and billing period you chose, its status and renewal date, the card brand and last four digits, and the email address you used at checkout.

3. How we use your information

Provide, operate, secure, and improve LetX (including compiling your documents and syncing real-time collaboration).
Authenticate you and protect against abuse, fraud, and security incidents.
Understand who our users are and how they use LetX, so we can prioritise features (analytics and product research).
Send you service and account emails (verification, password reset, invitations, important notices). Marketing emails are optional and you can opt out.
Comply with legal obligations and enforce our Terms.

Legal bases (GDPR): we process data to perform our contract with you (providing the service), for our legitimate interests (improving and securing LetX, product analytics), with your consent (optional profile fields, AI features, marketing), and to comply with law.

4. AI features & your documents

AI assistance in LetX is opt-in. Unless you explicitly enable an AI feature, your documents are not sent to any AI model. When you do use an AI feature, the relevant text is sent to third-party model providers (via our AI gateway) solely to generate your result. We choose providers that do not use inputs from our API to train their models and that offer limited or zero data-retention options where available; retention and processing practices vary by provider and may change, and we update our sub-processors from time to time.

We never sell your work, and we never use your private documents to train AI models without your explicit, opt-in consent. If we ever offer to use your content to improve or train our own models, that will be a separate, clearly-labelled choice you can decline, and we would use anonymised or aggregated data wherever possible.

Aggregated & de-identified data. We may create and use aggregated, anonymised, or de-identified information, which does not identify you and cannot reasonably be used to identify you, for any lawful purpose, including operating, analysing, securing, improving, and promoting LetX. Such data is not treated as your personal information.

5. How we share information (sub-processors)

We do not sell your personal data. We share it only with service providers who process it on our behalf, under appropriate confidentiality and data-protection obligations. Our providers may change as the Service evolves; the current key sub-processors are:

Amazon Web Services (AWS): cloud hosting, file storage, database, and transactional email (SES).
Cloudflare: DNS, CDN, and delivery of the web app and public assets.
Google and GitHub: optional sign-in (OAuth), if you use them.
Zoho: our business email/support inbox.
AI model providers (via our AI gateway), only when you use an opt-in AI feature (see §4).
Lemon Squeezy, LLC (merchant of record). To sell subscriptions, take payment, issue invoices, and handle sales tax/VAT. Applies only if you buy a paid plan.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

6. Data retention

We keep your information for as long as your account is active or as needed to provide the service. When you delete your account, we delete or anonymise your personal data and documents within a reasonable period, except where we must retain some data to meet legal, accounting, or security obligations.

Two things are kept to a shorter clock on purpose. A document you upload as proof of academic status is deleted within about a day of the decision, whatever that decision was, because once the answer is known the document has no further use and keeping it only creates risk. Billing records outlive the account instead: deleting your letX account does not cancel a subscription you bought through Lemon Squeezy, and we need the record to resolve a refund or a dispute. Cancel the subscription first if you want both gone.

7. Cookies

We use only strictly-necessary cookies: an HttpOnly cookie to keep you signed in and rotate your session, short-lived cookies for the OAuth sign-in flow, and local storage for your preferences (such as theme). We do not use third-party advertising cookies.

8. Security

We use appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest for stored data, hashed passwords, role-based access controls, and private, signed access to your files. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of material incidents as required by law.

9. International transfers

We are based in Bangladesh and use cloud infrastructure located in various regions (including Asia-Pacific). Your information may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

10. Your rights & choices

Depending on your location (including under GDPR and similar laws), you may have the right to:

Access, correct, or delete your personal information.
Export your documents and data.
Object to or restrict certain processing, and withdraw consent (e.g. AI features, optional fields, marketing).
Lodge a complaint with your data protection authority.

To exercise any of these, email us at support@letx.app.

11. Children

LetX is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you. Continued use of LetX after changes means you accept the updated policy.

13. Contact us

Questions or requests? Contact Shahriar Labs at support@letx.app (support & privacy) or hey@shahriarlabs.com (Shahriar Labs, Dhaka, Bangladesh).