This policy describes how Xenmark handles data on the marketing site and inside the Xenmark application. This document reflects Xenmark's current data-handling practices. For questions, contact support@xenmark.app.

1. Scope

This policy applies to the Xenmark marketing website (www.xenmark.app), the free browser tools published on it at www.xenmark.app/tools/, and the Xenmark application (my.xenmark.app). The marketing site is static: it has no forms and no accounts, so nothing you submit is collected there. Requests to it are still logged, as set out below. All account-related data handling happens inside the Xenmark application.

2. What the marketing site does

The marketing site does not require an account, does not store user data, and does not process payments. It serves static HTML, CSS, and JavaScript only.

No login or signup happens on the marketing site.
No drawings, comments, or project data live on the marketing site.
Server logs may record standard request metadata (IP address, user agent, request path) for security and operational purposes.

3. The free browser tools

The tools at www.xenmark.app/tools/ work differently from the rest of Xenmark. Nothing you open with them reaches us.

Your files are never uploaded. When you open a file with one of the tools, it is read and processed by code running inside your own browser tab. It is not sent to Xenmark, to any other company, or to any server. There is no upload step, no queue, no temporary server-side copy and no fallback that sends the file anywhere if something goes wrong. If a tool cannot do something in your browser, it says so and stops.

Nothing about your files is reported either. We do not collect file names, sizes, page counts, contents, or any statistic derived from what you open. We do not know which files you use, how many, or whether a tool succeeded.

Nothing is stored on your device. The tool pages set no cookies. They write nothing to local storage, session storage, IndexedDB or any browser cache. Everything a tool holds lives in the page's memory for as long as the tab is open, and goes when you close it. Anything you download is a file you chose to save, in the place you chose to save it.

No account, no sign-in, no email. The tools ask for nothing about you. There is no registration, and no way for us to associate a page visit with a person.

No analytics on the tool pages. No analytics script, no tag manager, no pixel, no session recorder and no error-reporting service runs on them.

No third-party requests. Everything a tool page needs — its code, its styles, its fonts and its icons — is served from Xenmark's own domain. The pages make no request to any other domain, including no web-font service and no content delivery network belonging to anyone else.

How we know. These are not intentions. Every release of the tools is checked by an automated gate that reads the built site and fails the release if it finds a storage API, an off-domain request, a service worker, or a transport that could carry data away. The tools cannot ship if any of the statements above stops being true.

What we do see. Requests for the tool pages themselves reach our host, Cloudflare, as requests for any page on this site do. We keep no per-visitor request logs and have no way to look up who asked for what: what reaches us is aggregate traffic — counts of page requests and the countries they came from — which cannot identify you. Cloudflare processes ordinary request metadata at its own edge for delivery and security, as described in section 6 and on the Data Processing page. The files you open with a tool appear in none of it, because they never leave your browser.

The review service is separate. Xenmark's drawing review service is a different product with a different model: it is shared work, and drawings you use with it are uploaded to your Xenmark project. Everything above applies to the free tools only. Following a link from a tool page into the review service takes you to the service described in the rest of this policy.

4. What the Xenmark application collects

When you create an account in the Xenmark application, Xenmark collects the information needed to operate the service:

Account information — name, email address, and authentication credentials.
Project data — projects, drawings, revisions, comments, replies, statuses, and member assignments you create or upload.
Usage telemetry — basic operational logs needed to run the service reliably.
Billing information — billing is handled by Stripe. Stripe processes payment details directly; Xenmark does not store full card numbers.

5. How data is used

To operate the Xenmark application and deliver the features you use.
To maintain account security and detect abuse.
To communicate with you about your account, the service, and important changes.
To improve the product based on aggregate, non-identifying usage patterns.

Xenmark does not sell user data.

6. Data sharing

Xenmark relies on a small set of third-party processors to operate the service:

Cloudflare — domain registration and DNS, frontend hosting and CDN for the marketing site and application, R2 object storage for project files and attachments, and Workers for token-gated storage access and serverless processing.
Supabase — authentication, relational database (projects, drawings, revisions, comments, members), Edge Functions for server-side logic, and Vault for secrets management.
Resend — transactional email delivery (account notifications, archive expiry reminders, and other service emails).
Stripe — billing and payment processing for paid plans. Stripe processes payment details directly; Xenmark does not store full card numbers.
Backblaze — encrypted operational backup storage for selected project files, attachments, and object metadata. Used for internal recovery and incident response only; not a customer-facing feature.
Google Fonts — static web-font delivery in the application only (DM Mono and Syne). A signed-in user's browser connects to fonts.googleapis.com and fonts.gstatic.com to load them. Google may receive IP address and ordinary HTTP request metadata. No project content is transmitted. This site does not use Google Fonts. Every page on www.xenmark.app, including the free tools, serves its fonts from Xenmark's own domain, so visiting this site sends nothing to Google.
UNPKG — public CDN used to deliver the pdf-lib JavaScript library in the application. A user's browser may send IP address and ordinary request metadata when the library is loaded. No project content is transmitted.

Each processor handles only the data necessary for their specific function. For a full list of subprocessors and data transfer details, see the Data Processing page.

This list covers the marketing site and the application. It does not describe the tool pages, which make no request to any other domain at all — see section 3.

7. Data retention

Project data persists for as long as your account is active. When an account is deleted, associated project data is removed within a reasonable period, except where retention is required for legal, accounting, or security reasons.

8. Your rights

You may request access to, correction of, export of, or deletion of personal data associated with your account. If you are signed in, you can request a data export or account deletion from Account & Security in the Xenmark app. You can also submit a data request by emailing support@xenmark.app or using the contact page.

9. Security

Xenmark uses standard security practices including encryption in transit (HTTPS), access-controlled project isolation, and role-based permissions. No system is perfect, and Xenmark recommends following normal account hygiene (strong passwords, prompt response to suspicious activity).

10. Cookies

The marketing site does not set tracking cookies. The Xenmark application uses cookies and similar technologies as needed for authentication and session management.

11. Changes to this policy

Material changes to this policy will be communicated through the application and reflected in the "Last updated" line above.

12. Contact

Xenmark is operated by Xenmark AS, org. nr. 937 996 799, Norway.

Questions about privacy? Email support@xenmark.app or use the contact page and we'll get back to you.