We built docstead to be private by design. Here's exactly what we collect and why.
What we collect
- Username — to identify your account
- Password hash — securely hashed, we can't see your actual password
- Encrypted documents — encrypted on your device before reaching us
- Payment info — handled entirely by Stripe, we never see your card
What we don't collect
- Email address — we don't ask for it, we don't store it
- Your document content — it's encrypted before it leaves your browser
- Analytics or tracking — no Google Analytics, no cookies for tracking
- Your IP address — we don't log it
Zero-knowledge encryption
Your documents are encrypted using XChaCha20-Poly1305 before they leave your browser. The encryption key is derived from your password using Argon2id. We never see the key. We literally cannot read your documents — not won't, cannot.
Your rights
- Export your data — available anytime in Settings
- Delete your account — available anytime in Settings, immediate and permanent
- No lock-in — your data is yours, export it whenever you want
Contact
Questions? Reach out at sup@docstead.com
Last updated: January 2026