Privacy Policy

Effective Date: March 1, 2026 · Last Updated: March 1, 2026

1. Overview

Welcome to ComfyTex ("we", "us", or "our"). ComfyTex is an AI-assisted document conversion service that transforms Markdown into publication-quality LaTeX. This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it.

By creating an account or submitting a document for conversion, you agree to the practices described below. If you do not agree, please do not use the service.

Key fact to know upfront: When you submit a document, its text content is transmitted to third-party large language model (LLM) APIs for processing. Please review Section 4 before uploading sensitive or confidential material.

2. Information We Collect

We collect only what is necessary to operate the service:

Account Information

Your email address and a hashed password, collected when you register. Account data is stored and managed by Supabase Auth. We do not store your password directly.

Document ContentSent to LLM APIs

The text content of Markdown files you submit for conversion. Files are accepted up to 500 KB per job.

This content is transmitted to third-party LLM API providers for AI-assisted processing (see Section 4). Converted output files are stored temporarily on our servers until the job is purged.

Job Metadata

Per-conversion records including: job ID, job status and lifecycle timestamps (created, queued, running, completed, purged), processing duration, and LLM token usage counts. This data is stored in a PostgreSQL database and linked to your account via a Supabase user UUID.

Technical Identifiers

IP address — used solely as a fallback rate-limiting key for unauthenticated requests. Authenticated requests are rate-limited by user UUID instead.

Server logs — contain timestamps, job IDs, user UUIDs, HTTP status codes, and error traces. Logs do not contain document text. Retained for up to 90 days on a rolling basis.

3. How We Use Your Information

Provide the service: Process your Markdown files through the conversion pipeline and deliver the LaTeX output.
Account management: Authenticate you on sign-in, manage your session, and associate jobs with your account.
Abuse prevention: Apply per-user rate limits (10 job creations per minute; 30 list queries per minute) to prevent automated misuse.
Aggregate analytics: Generate anonymised, aggregate statistics (total jobs, token consumption trends) for internal operational review. No individual-level analysis of document content is performed.
Debugging & support: Diagnose pipeline errors using logs and metadata. We do not read document content unless you explicitly share it with us for support purposes.
No AI training: ComfyTex does not use your document content to train any AI model. Document content is used solely to process your conversion job and is not retained or repurposed for model development.

4. Third-Party Services & Data Sharing

Important: Your document's text is sent to external AI providers for processing. Do not submit documents containing personally identifiable information (PII), confidential business data, credentials, or NDA-protected content.

SupabaseAuthentication & user identity

Email address and authentication tokens.

RailwayCloud hosting, database & file storage

Job metadata, converted output files, and server logs. All data remains within Railway's infrastructure.

DeepSeek / Qwen LLM APIsAI document processing

The full text of your uploaded Markdown document is transmitted to these providers during the conversion pipeline (Overviewer → Checker → Assembly stages). Their data retention and use policies apply.

We do not sell, rent, or share your data with advertising networks, data brokers, or any other parties not listed above.

ComfyTex is not responsible for any service interruption, data breach, policy change, or other failure on the part of any third-party provider listed above. We cannot guarantee how DeepSeek/Qwen handle submitted data at the API level. Please review their current policies before submitting sensitive content.

5. Data Retention & Deletion

Converted output filesRetained on Railway Volume storage until the job enters the "purged" state. Once purged, files are permanently deleted and cannot be recovered. Download your output promptly after conversion.

Job metadataRetained in our PostgreSQL database indefinitely to maintain your job history display. Purged jobs remain in the history as non-downloadable, greyed-out entries.

Account dataRetained by Supabase until you delete your account. On account deletion, your Supabase user record and associated job history are removed.

Server logsRolling 90-day retention. Logs are automatically deleted after this window.

LLM API dataSubject to the individual data-retention policies of DeepSeek and Qwen. We do not control their retention periods.

6. Security Measures

We take reasonable technical measures to protect your data:

All traffic is encrypted in transit via HTTPS/TLS (managed by a Caddy reverse proxy).
Authentication uses Supabase-issued JWTs with RS256 or HS256 signature verification; tokens are verified on every API request.
The PostgreSQL database is accessible only within Railway's internal network.
File uploads are rejected above 500 KB, limiting the blast radius of any processing anomaly.
Rate limiting by authenticated user UUID prevents credential-stuffing and brute-force attacks.

No transmission over the internet is 100% secure. While we use industry-standard practices, we cannot guarantee absolute security of data in transit or storage.

7. Cookies & Local Storage

ComfyTex does not use tracking cookies, advertising cookies, or third-party analytics scripts.

What is stored in your browser

Your Supabase session token (access token + refresh token) is persisted in localStorage by the Supabase client library. This is strictly a functional necessity — it keeps you logged in between page reloads. It contains your user UUID and session expiry; it does not contain document content or any behavioural tracking data.

8. Your Rights

You have the following rights with respect to your personal data:

Access: You can view all your jobs and their metadata from the Job History panel within the application.
Export: Converted output files (.tex, .pdf) can be downloaded directly from the application at any time before purging.
Deletion: You may request deletion of your account and associated data by contacting us at the email below. Account deletion will remove your Supabase user record and associated job history.
Correction: To update your email address, use the Supabase account management flow (password reset email).
Portability: Your LaTeX output files are plain text and are fully portable once downloaded — no proprietary format lock-in.

To exercise any of these rights, please contact us at [email protected].

9. Hong Kong PDPO Compliance

ComfyTex complies with the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) ("PDPO") as a data user in the HKSAR. The six Data Protection Principles set out in the PDPO govern how we collect, hold, process, and use your personal data.

Personal Information Collection Statement (PICS)

In accordance with PDPO requirements, when we collect personal data from you we inform you of:

Purpose of collection: to operate your account, process conversion jobs, prevent abuse, and improve the service (as described in Section 3 above).
Classes of transferees: Supabase (authentication), Railway (hosting and storage), DeepSeek / Qwen LLM APIs (document processing), as described in Section 4 above.
Your right to request access to and correction of your personal data, as described below.

Data Access Request (DAR)

Under PDPO Sections 18–22, you have the right to: (a) confirm whether we hold personal data about you; and (b) obtain a copy of that data. To submit a Data Access Request, please send a written request to [email protected]. We will respond within 40 days as required by the PDPO. A reasonable fee may be charged in accordance with the PDPO.

Data Correction Request (DCR)

Under PDPO Section 22, you have the right to request correction of any personal data held by us that is inaccurate. Please submit correction requests in writing to [email protected].

Privacy Commissioner for Personal Data (PCPD)

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data: www.pcpd.org.hk.

Cross-Border Data Transfer

Your personal data (email address and authentication tokens) is transferred to Supabase, whose infrastructure may be located outside Hong Kong. Document content is transferred to DeepSeek / Qwen APIs, which may process data outside Hong Kong. By using the service, you consent to these transfers as necessary for the operation of the service.

10. Children's Privacy

ComfyTex is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes (such as new data-sharing arrangements), we will update the "Last Updated" date at the top of this page. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

For significant changes that materially affect how we use your data, we will make reasonable efforts to notify registered users via email.

12. Contact Us

Questions, requests, or concerns about this Privacy Policy? Please reach out:

Email: [email protected]