Last updated: 30 June 2026
Operator: Invertase (invertase.io)
This Privacy Policy explains how Invertase (“we”, “us”, “our”) collects, uses, and shares information when you use docs.page — the documentation hosting platform at docs.page, including the marketing site, hosted documentation sites, APIs, and related services (collectively, the “Service”).
Please read this policy together with Invertase’s privacy policy, which describes how Invertase handles personal information across its business more generally.
This policy applies when you:
- visit the docs.page marketing site (
docs.page); - read documentation hosted on docs.page (for example
docs.page/{owner}/{repo}, vanity subdomains such as{owner}.docs.page, or custom domains pointed at docs.page); - use platform features such as search, MCP, local preview, or the optional Ask AI agent panel on supported sites;
- interact with the docs.page GitHub App (for example PR preview comments).
It does not replace the privacy policies of documentation publishers (the people or organisations who own the GitHub repositories whose content is displayed). Those publishers may collect additional information through their own configuration of the Service — see Section 6.
docs.page is a hosting platform. Different parties may be responsible for different processing activities:
| Activity | Typical role |
|---|---|
| Operating docs.page, platform analytics, abuse prevention, agent rate limiting, caching and delivery of public GitHub content | Invertase acts as a data controller |
| Choosing what documentation to publish, configuring optional analytics scripts, enabling Ask AI with a provider API key | The documentation publisher (repository owner) typically acts as a data controller for their site-specific choices |
| Ask AI message processing via a publisher-configured AI provider (for example OpenAI, Anthropic, Google) | The AI provider processes message content under the publisher’s configuration; Invertase processes messages to deliver the feature |
If you have questions about a specific documentation site’s practices (including analytics they have enabled), contact that site’s publisher directly.
We collect only what we need to operate, secure, and improve the Service.
To understand how the Service is used and to maintain reliability, we collect server-side usage events through PostHog (EU data region). Analytics run on our servers — we do not set analytics cookies in your browser for this purpose.
Events are tied to repository identifiers (for example owner/repo) and page paths, not to named user accounts. We configure PostHog so that person profiles are not built from this data.
Platform analytics may include:
| Event type | Examples of data captured |
|---|---|
| Documentation traffic | Page views (repository, page path, branch/ref where applicable) |
| Reliability | Bundle loads, rendering errors |
| Product features | MCP access, agent panel sessions, GitHub App preview comments |
| Abuse prevention | Rate-limit events (see Section 3.2) |
For platform analytics, we do not send your IP address to PostHog. Where we need to distinguish requests (for example, to measure rate-limiting), your IP address is hashed before it is used as an identifier, and PostHog’s IP-based geolocation is disabled — so PostHog does not receive your raw IP address or infer your location. Events are recorded without building a person profile. We do not use platform analytics to sell your data or for cross-site advertising.
On documentation sites where the publisher has enabled Ask AI:
- We issue session cookies so the agent panel can function securely (session authentication and CSRF protection).
- We store a preference cookie indicating whether you left the agent panel open or closed.
- We apply rate limits using network identifiers (such as IP address) and per-repository limits to prevent abuse.
- Chat messages you send are transmitted to the AI provider configured by the documentation publisher. Invertase does not use your chat content for advertising. Publishers choose their provider and credentials; refer to that provider’s privacy policy for how they process message content.
Repository administrators who register an agent provide an encrypted API key; we store that credential so the Service can call the provider on behalf of the site. We do not publish those credentials.
docs.page serves documentation from public GitHub repositories. We fetch, cache, and render that content (including configuration in docs.json). We do not require visitors to sign in with GitHub to read documentation.
If you install the docs.page GitHub App, GitHub sends webhook events (for example when a pull request is opened) so we can post preview links. That processing is governed by GitHub’s terms and privacy policy as well as this policy.
Like most online services, our infrastructure may temporarily process:
- IP address and request headers;
- timestamps and requested URLs;
- error and performance data.
We use this information to deliver the Service, troubleshoot failures, and protect against abuse.
We may store cookies or similar technologies for essential interface behaviour — for example, keeping a sidebar open or closed. These are not used for advertising.
On the standard read-only documentation experience, we do not require you to create a docs.page account, and we do not intentionally collect your name or email address unless you contact us directly.
We use the information described above to:
- host and deliver documentation from public GitHub repositories;
- provide search, previews, MCP, and optional Ask AI features;
- measure aggregated usage and improve the Service;
- detect, prevent, and respond to abuse, rate limits, and security incidents;
- post documentation preview links when the GitHub App is installed;
- comply with legal obligations.
We do not sell personal information.
Where the GDPR or similar laws apply, we rely on:
| Processing | Legal basis |
|---|---|
| Hosting and delivering documentation you request | Legitimate interests (operating a free public documentation hosting platform, caching public content, and delivering web traffic safely at the user’s request) |
| Platform analytics and product improvement | Legitimate interests (understanding use of a free hosted platform, keeping it reliable), balanced against your rights |
| Security, rate limiting, and fraud prevention | Legitimate interests / legal obligation |
| Ask AI session cookies | Legitimate interests / performance of a service (strictly necessary for the feature you use) |
| Responding to privacy requests | Legal obligation / legitimate interests |
You may object to processing based on legitimate interests as described in Section 11.
Publishers can configure optional third-party scripts in their repository’s docs.json file — for example Google Tag Manager, Google Analytics, or Plausible — which may load in the visitor’s browser when viewing that publisher’s documentation (typically on custom domains).
When those scripts are present:
- the publisher (not Invertase) chooses which tools run and for what purpose;
- those tools may set cookies or collect identifiers in the browser under the publisher’s control;
- you should read the publisher’s privacy notice for details.
Invertase provides the hosting integration but does not control how publishers use optional analytics.
Local preview and certain preview modes intentionally do not load publisher-configured analytics scripts.
| Cookie / storage | Purpose | Duration (approx.) |
|---|---|---|
agent_session | Secure Ask AI session | Session / short-lived (about 1 hour) |
agent_session_csrf | CSRF protection for Ask AI | Session / short-lived (about 1 hour) |
dpa_open_{owner}_{repo} | Remember agent panel open/closed state | Up to 1 year |
| Sidebar state cookie | Remember sidebar expanded/collapsed | Up to 7 days |
Platform analytics (PostHog) are server-side only and do not set cookies in your browser.
You can control cookies through your browser settings. Disabling session cookies may prevent Ask AI from working.
We share information only as needed to operate the Service:
| Recipient | Why |
|---|---|
| PostHog (EU region) | Platform usage measurement |
| GitHub | Source control integration and GitHub App webhooks |
| AI providers (when Ask AI is enabled) | Process chat messages per publisher configuration |
| Infrastructure providers (hosting, CDN, DNS) | Run and deliver the Service |
| Professional advisers | Legal, security, or compliance advice where required |
| Authorities | When required by law or to protect rights and safety |
We require subprocessors that handle personal data to provide appropriate safeguards.
The following categories of providers process data on our behalf. Specific vendors may change; we will update this policy when we make material changes.
- Hosting and deployment — application runtime and databases
- Content delivery (CDN) — caching and edge delivery
- Analytics — PostHog (EU region:
eu.i.posthog.com) - Source control — GitHub (public API and GitHub App)
- AI inference — whichever provider a publisher configures for Ask AI (not used for all sites)
docs.page is operated by Invertase Limited, registered at Banks Sheridan, Datum House, Electra Way, Crewe, Cheshire, England, CW1 6ZF.
Invertase is based in the United Kingdom. PostHog analytics for docs.page is configured to use PostHog’s EU data region. Other providers may process data in the United States or other countries. Where required, we implement appropriate safeguards approved under UK data protection law, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission’s Standard Contractual Clauses.
We keep information only as long as necessary:
| Data type | Retention |
|---|---|
| Platform analytics events (PostHog) | Retained for 12 months, after which it is deleted or aggregated |
| Ask AI chat messages | Routed to the AI provider configured by the publisher; not retained by Invertase beyond what is needed to handle the request |
| Ask AI rate-limiting identifiers (hashed) | Short-lived; not retained beyond the applicable rate-limit window |
| Ask AI session data | Short-lived; session cookies expire within about an hour |
| Encrypted publisher API keys | Until the publisher removes the agent or deletes the repository configuration |
| Security and infrastructure logs | Retained for up to 90 days |
Depending on where you live, you may have the right to:
- access personal information we hold about you;
- correct inaccurate information;
- delete information or object to certain processing;
- restrict or port your data;
- withdraw consent where processing is consent-based;
- complain to your local data protection authority.
To exercise these rights, please email us directly at products@invertase.io. To protect your privacy and security, do not use public channels (such as GitHub Discussions) to submit data protection or identity verification requests. We may need to verify your request. If your question relates to a specific documentation site’s optional analytics or content, we may direct you to that site’s publisher.
The Service is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will post the revised version in this repository and update the “Last updated” date. Material changes may also be noted on docs.page or in project release notes.
Invertase Limited
Banks Sheridan, Datum House, Electra Way, Crewe, Cheshire, England, CW1 6ZF
Web: invertase.io
For privacy questions about docs.page, open a GitHub Discussion or email products@invertase.io.