Privacy policy
Last updated 9 August 2026.
Your documents
Your file is uploaded to our server. Reading a .docx or .pdf, working out which of its lines are code, and writing a highlighted file back out all happen there. This is a change: earlier versions did the work in the browser and this page said the file never left your device. It does now, and saying so plainly matters more than the claim did.
What happens to it:
- It travels over HTTPS and is held in memory only. It is never written to disk, never placed in a database, and never copied to storage of any kind.
- It is kept only so that changing a mark or a theme does not mean uploading the file again.
- It is deleted within 20 minutes of your last action, and immediately when you close the tab or press “Highlight another file”. A restart of the server deletes everything held at that moment.
- It is never shared, sold, or used to train anything. Nobody reads it.
- The server logs that a request happened and whether it succeeded. It does not log the file, its name, or its contents.
What this means in practice: the operator of this site could, in principle, see a document while it is being processed. We do not, and nothing is retained to make it possible afterwards — but a promise is not an architecture, and you should weigh that before uploading something sensitive.
What is sent to Google — and only if you press “Refine output with AI”:
- Not the whole document. Only the lines the detector was uncertain about (under 50% confidence), plus up to two lines before and three after each for context. Each is sent with its real line number.
- The context stops at a blank line rather than reaching past it, and blank lines are never sent.
- It goes to Gemini 3.1 Flash Lite via the Gemini API
(
generativelanguage.googleapis.com), in batches of at most 150 lines, so the model can name the lines it thinks were classified wrongly. - If the detector was confident about every line, no request is made at all and nothing is sent, even if you press the button.
- This happens only when you press that button. It is not automatic and it is not on by default. If you never press it, no part of your document goes anywhere but our own server.
Once text reaches Google it is governed by Google’s Gemini API terms, not by this page. Free-tier API usage in particular may be retained and reviewed by Google, including by humans, and used to improve their products. Do not put confidential documents through this tool. If the content is under an NDA, unreleased, or someone else’s to protect, this is the wrong tool for it.
You can see exactly what leaves your browser: open your browser’s network panel while processing a document. You will see the upload to this site, and nothing else unless you press the AI button.
What is stored in your browser
Preferences only, in localStorage: the page theme
(hl-theme), the code theme (hl-code-theme), the code
font (hl-code-font) and whether listings carry line numbers
(hl-line-numbers). None of it leaves your browser and none of it
identifies you. Clearing site data removes it.
No cookies are set.
Analytics
If privacy-preserving, aggregate analytics are enabled on this site, they record page views and referrers only. They do not use cookies, do not fingerprint visitors, and have no access to the contents of any file you process. Note that this is separate from the Gemini API call described above, which does receive your document’s text.
If you are deploying this site yourself: state here exactly which analytics provider you use, or delete this section if you use none. Do not leave it vague.
If you submit an email address to be notified about a feature, it is used for that single announcement and nothing else. It is not sold, shared or added to any other list. Reply to any message to be removed.
If you email support directly, that correspondence is retained only as long as needed to resolve your question.
Advertising
This site currently serves no advertising.
If you later add an ad network: users in the EEA, UK and Switzerland must be served through a Google-certified consent management platform implementing Consent Mode v2 and IAB TCF, and this section must be updated to name the network and describe what it collects. Do not enable ads before that is in place.
Third parties
The site loads no third-party scripts, fonts, or trackers. All code and assets are served from this domain. The PDF engine is Mozilla's open-source pdf.js, bundled and served from here rather than from a CDN, and it too runs entirely in your browser.
Your rights
Since no personal data about you is collected in the course of using the tool, there is generally nothing to access, correct or delete. If you have sent an email address or corresponded with support, you may request its deletion at any time by writing to hello@highlitdocs.com.
Children
This tool is not directed at children and collects no personal information from anyone, including children.
Changes
Material changes to this policy will be reflected in the date at the top of the page. If the no-upload guarantee ever changes — it is not planned to — that change will be stated prominently on the tool itself, not buried here.