Privacy & cookies.

Who operates this website

Edit. is an open-source project by Pavel Sumin. To contact the maintainer about privacy, access, deletion or consent, use the contact options at pavelsumin.com. Do not post personal data, API keys or passwords in public GitHub issues.

Essential storage

The administrator’s elp-session cookie keeps the editor signed in for up to eight hours. It is HttpOnly, SameSite=Strict and Secure in production, and contains a signed session token rather than the password. Browser local storage under edit-theme remembers your chosen light or dark appearance until you clear it. Browser local storage under edit-cookie-consent-v1 remembers your acceptance or rejection, timestamp and analytics property for up to 180 days. If browser storage is unavailable, your selection applies to the current page and may be requested again. Demo edits and unsaved drafts stay in browser memory and are reset on reload.

Optional Google Analytics

If this deployment has an analytics property configured and you consent, Google Analytics receives usage information such as page views, browser/device details, referrer and approximate location. Google processes request information including IP addresses; Google states that GA4 does not log or store individual IP addresses. Analytics cookies such as _ga and _ga_* identify a browser and may last up to two years, depending on the property settings. Reporting retention is controlled by that property’s Google Analytics settings. Admin and embedded preview pages do not initialize analytics. We do not send editor field values, admin passwords or API keys as analytics events.

Consent is the basis for optional analytics. Read Google’s privacy policy and GA4 data practices. Withdrawing consent stops future collection on this browser; it does not automatically delete previously collected reports. Contact the maintainer for deletion requests.

Hosting, published content and security

Vercel hosts this website and processes network requests and technical logs needed to deliver and protect it. Supabase stores published text, uploaded images and security counters. All content in this editor’s published content table and its public image bucket is intended to be public. Do not upload personal or confidential material there. Login protection uses shared counters; deployments configured to trust a proxy may also use client IP information for throttling. These services may process data in countries different from yours; the selected project regions and provider terms govern those transfers.

Published content remains until the operator changes or deletes it. Replacing an image does not automatically delete the previous upload. Security counters expire logically according to their throttle windows; infrastructure logs and backups follow the operator’s provider settings. Hosting and security processing are used to operate the service and prevent abuse.

Optional Gemini assistance through the CLI

Normal website browsing and editor use do not send your content to Gemini. When you explicitly run an AI command, the brief and selected text-field definitions/defaults are sent for generation. The shared service forwards these to Google and keeps HMAC-hashed client-IP quota fingerprints and daily counters in Supabase. Failed generation attempts also consume quota. Old quota rows are removed when the budget function processes a later day; removal is not a scheduled daily job.

With your own GEMINI_API_KEY, the CLI contacts Google directly and does not send that key to this website. Do not include secrets or sensitive personal information in prompts. Google’s Gemini API terms govern processing and possible use of prompts and responses, including different rules for free and paid services. Running an AI command is a separate, explicit action; accepting analytics is not consent to AI processing.

Your choices and requests

You can reject analytics, change your selection using Cookie settings, clear browser storage, and use browser privacy controls. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and raise a complaint with your data-protection authority. Contact the maintainer using the link above with enough information to identify your request. We do not sell personal data or use this website to make automated decisions with legal or similar significant effects.

Providers and changes

Read the privacy policies of Vercel and Supabase. This page describes this deployment’s actual features. If those features or providers change, this policy and, when needed, the consent choice will be updated.