Privacy policy

Your document

To convert it and transmit it. Destroyed on the retention schedule, and never attached to an email.

Your email address

To send you the status and the transmission record, and given to Stripe so it can email you a payment receipt. Nothing else.

Destination fax number

To send the fax, and it appears on your record.

Your name and the recipient's

Optional. Printed on the record if you supply them.

Payment

Handled by Stripe. We store the transaction reference, the amount, and whether it was authorized, captured or released. Never card details.

Basic request data

IP address and browser, on each request, to keep the price you are shown consistent across the pages you visit. That calculation keeps nothing, and its result is the price you see.

Where your fax was sent from

When you press send we record the version of the terms you accepted and the internet address our hosting provider reports. Both stay in our database and neither is printed on the record we send you; the retention policy says why we keep them.

Ad click identifier

Only if you arrived from one of our ads. Google puts an opaque code in the link; we record that the click arrived and which page it landed on, and we store the code again with your fax if you send one. We report back to Google when a fax is confirmed so we can tell whether advertising pays for itself. It identifies the click, not you.

We do not ask for a phone number, a postal address, or anything else the transaction does not require.

Nothing in this service puts your document in front of a person. It is converted by software and handed to the fax network. The stored file can be opened by whoever holds the storage keys, which is the one person who runs this business, and it is not opened. Take that as worth exactly what an unverifiable promise is worth. What you can check is that the file is gone in 24 hours, and that your record says so. The deletion is written to an audit table as well, which is our own accounting rather than something you can read.

Four services handle your document or your card, and this is all each one gets:

• —The fax network places the call. It receives the converted pages and the destination number.
• —Supabase stores your document, the converted pages and your record, in the United States.
• —Netlify serves this site and runs the code your upload arrives at, so your document, your fax number and your email address pass through it.
• —Stripe takes the payment and gets your email address to send you a receipt. It never receives your document.

Behind those sit the ordinary parts of running a website. None of them is ever sent your document:

• —Resend delivers our email, so it receives your address and the contents of the record — the number dialed, any names you gave, each filename. It also carries the same link you get, which downloads the pages while they still exist.
• —Inngest runs the background jobs that send your fax and destroy it afterwards, so it receives the fax network's own message about your call, which names the number dialed.
• —Sentry and PostHog tell us when the site breaks and how it is used. They get pages, browsers, our own internal identifiers, how many documents you added and the pages and bytes they came to, and the reason Stripe gives when a card is declined. PostHog also gets your internet address; Sentry is configured not to.
• —PostHog records what you see and where you move on the pages that explain the product — this one, the homepage, pricing, help and the guides. It does not record the screens where you send a fax or read a record, so your document, your fax number, your email address and your card details are never in a recording.
• —Google's tag measures our advertising, and gets what the paragraph below describes.

If the business is sold or reorganized, transmission records move with it and the buyer is bound by the policy in force when your record was created.

We do not sell your information and we do not share it to target advertising at you. Google’s tag runs on every page, sets its own cookies, and can recognize you on other sites that use Google advertising. When a fax is confirmed we report the sale to Google with the amount and the click your visit came from, never your document, your fax number or your email address. We build no advertising audiences and we run no remarketing.

We set six kinds of cookie of our own, all of them httpOnly, so JavaScript in your browser cannot read them. fmd_arm holds the price you were quoted, for a year. fmd_click holds the ad click your visit came from, for 90 days. fmd_cover is a random number set on the cover sheet page, and fmd_test is one set on the free test fax page, each for a year, so we can count how many people who use one go on to send a fax. fmd_land holds the page your visit started on, how you arrived — from a search engine, an AI assistant, another site, an ad or directly — and the day, for 30 days; if you send a fax, those three facts are stored with it, so we can tell which of our pages lead to a fax being sent. It holds no search terms and no address of the site you came from. fmd_inbound_ followed by a short code is set when you start a test on our inbound test number, for 30 minutes, and is what lets the browser that started the test, and no other, see the first page of the fax it received. None of them carries your name, your email address or your fax number. PostHog, Stripe and Google set their own, and your browser holds the filenames you added for as long as the tab is open.

Your document is destroyed 24 hours after the transmission reaches a final result, or, if you upload and never send, two hours after the upload and by the next hourly sweep. The full schedule, and what the record we keep does and does not contain, is in the retention policy.

The status and record links we email you contain a token, and that token is the only credential involved — there is no password because there is no account. Anyone holding the link can see your record, and while your converted pages still exist they can download those too. Treat the link the way you would treat the document.

After the pages are destroyed the link still opens the record, which from that point contains no document content. We do not index these pages and search engines are told not to.

You can ask us to delete a transmission record by writing to support@faxmydoc.com with the record ID, and you can ask what we hold about a given record. We will respond within 30 days of a request we can verify. We have no marketing list.

This service is not directed at children and we do not knowingly collect information from anyone under 13. Goforth Digital Ventures LLC is based in Dallas, Texas, the service is offered to senders in the United States sending to US fax numbers, and information is processed in the United States. If this policy changes we will update the review date below, and material changes will not be applied retroactively to documents already uploaded.