# GiantMarkdown privacy policy

Effective date: 5 August 2026.

## Who is responsible

GiantMarkdown is a personal project operated by Simon Crouch, who is responsible for personal data processed through the site. Privacy questions or rights requests can be made through [Simon's LinkedIn profile](https://www.linkedin.com/in/simon-crouch).

## What GiantMarkdown does

The service converts supported documents into UTF-8 Markdown. It does not send documents to an LLM, use documents for AI training, sell them or share their contents for advertising. It deliberately excludes image processing: embedded images are not sent to a vision model, OCR is not run and images are not included in the Markdown.

Small document conversions run in a Web Worker in the browser. The document bytes remain on the device. If the local engine cannot handle the file, the browser can use the cloud path.

## What is uploaded

Before cloud conversion, the API validates the filename, media type and size. The browser uploads the document directly to a private Azure Blob Storage object with a short-lived, single-object authorisation. The document body does not pass through the Static Web Apps frontend API.

Cloud processing may temporarily hold the original document, generated Markdown, page fragments and a small job manifest. Logs contain operational identifiers, counts, durations and safe error codes, not document or Markdown content, upload URLs or access tokens.

## Legal basis

- Conversion is performed to provide the service requested, under UK GDPR Article 6(1)(b) where applicable.
- Security, operation and safe deletion use legitimate interests under Article 6(1)(f).
- Cookieless Microsoft Clarity analytics use legitimate interests where applicable.

## Retention

- On-device files and output remain only in browser memory until released.
- Upload authorisations last 15 minutes; unused uploads are collected after expiry and a five-minute grace period.
- Successful cloud conversions delete original files and working fragments at completion. Markdown output is deleted after readback.
- Failed jobs delete working data. Remaining manifests or output expire after 10 minutes without activity by default.
- Active job credentials are held in session storage until deletion or the end of the tab session.
- Download authorisations are read-only and last 10 minutes.
- Azure lifecycle deletion after two days is a safety net, not intended retention. Soft delete and versioning are disabled.

## Suppliers and analytics

Cloud data is processed using Azure Static Web Apps managed Functions and private Azure Blob Storage, currently in West Europe. Microsoft Clarity receives website usage information and is configured with cookies off. Filenames shown by the app are marked for masking, and document bytes are not sent to Clarity.

## Choices and rights

Users can delete cloud jobs from the result screen. Depending on the circumstances, UK GDPR rights can include access, correction, erasure, restriction, objection and portability. Complaints can be made to the [UK Information Commissioner's Office](https://ico.org.uk/make-a-complaint/).

## Important limits

GiantMarkdown is an anonymous self-serve service without accounts, an enterprise data processing agreement, guaranteed deletion SLA, access audit trail, OCR, image understanding or paid support. Organisations should perform their own assessment before uploading regulated or special-category data. Users remain responsible for upload rights and checking the converted output.