AutoLayoutAI // Privacy

Privacy Policy

What we store about you, why, who helps us run the site, and how to have your data changed or deleted. Last updated: October 10, 2026.

Who we are

AutoLayoutAI (autolayoutai.com) is run by Marko Markovic, 5mediadesign. He decides what personal data the site uses and why. Questions and requests about your data: privacy@autolayoutai.com.

The short version

• No advertising, no third-party analytics, no tracking pixels. We count page visits ourselves, without cookies. We do not sell or rent your data.
• One cookie, and only when you sign in: al_s, which keeps you signed in for up to 30 days.
• Your public profile and the GREPs you share are public. Your email address is never shown on the site.
• Write to us and we change or delete your data.

What we store, and why

Your account (GREP Library)

You sign in with a link we email you; there is no password. We store your email address to send that link and to tell you about the GREPs you share. If you fill in your profile we store your name, short bio, links and photo, and a profile address made from your name. The photo is kept in our file storage. Your profile becomes public when your first GREP is published; until then only you see it.

The sign-in link works once and expires after 15 minutes. We keep only a scrambled (hashed) form of it, and remove it after an hour. When you sign in we store a hashed session code and a hash of your browser's user agent string, so a stolen cookie is less useful. The session ends after 30 days, or when you sign out.

GREPs you share and requests you send

A GREP you share (title, Find and Change, description, examples, tags) is stored with your account and, once published, shown with your name under the license described in our Terms. A request on Ask for a GREP stores what you describe, your examples, the InDesign version you name, your name and email, and your account if you are signed in. We use it to answer you.

Messages, feedback and update notices

• Contact form: your name, email, topic, message and the country your request came from, to answer you.
• Feedback on the script: your rating and comment, and your name and email only if you give them. When you open the form from the script it also sends the script and InDesign version and your operating system, to help fix problems.
• Update notices: your email address, to tell you about new versions. Every notice has an unsubscribe link.

Downloads and abuse protection

When the script is downloaded we store the time, the version, the country, the browser's user agent, the page you came from, and a hashed form of your IP address. We use this to count downloads and to stop automated abuse. We never store the IP address itself. Hashed IP addresses are also used in short-lived counters that limit how often a form can be sent; these expire after an hour or a day.

Forms are protected by Cloudflare Turnstile, which checks that a person is sending them.

Usage counts

To see which pages help people and where they stop, each page sends us one short event when it opens (for example "library viewed" or "download page viewed"), when a Download link or a Copy button is clicked, and when you arrive from the script's own feedback links (then with the number of queries and replacements the script reports). We store the event name, the page path without its query, the time, the country and a hashed form of your IP address, nothing else. No cookie is used and nothing goes to a third party. If your browser sends Do Not Track or Global Privacy Control, no events are sent.

Server logs

Our hosting provider keeps technical logs of requests (such as the address requested, the time and errors) for a short time, so we can find and fix problems.

Who processes data for us

• Cloudflare hosts the site and its database and file storage, protects the forms (Turnstile), and sends and receives our email.
• Resend sends an email only when Cloudflare's email sending fails, so a sign-in link always arrives.
• Google: when link checking is turned on, links in profiles and GREP descriptions are checked against Google Web Risk; only the link is sent, not who you are. The fonts of the site are served from this site, so loading a page does not contact Google.

These companies may process data outside your country. They act on our behalf and under their own data protection terms.

How long we keep it

• Account, profile and shared GREPs: as long as your account exists, or until you ask us to delete them.
• Sign-in links: one hour. Sessions: up to 30 days. Form limits: up to a day.
• Contact messages, GREP requests and feedback: as long as needed to answer and follow up, then they may be deleted. Ask and we delete them sooner.
• Download records: kept for statistics. They contain no IP address.

Your rights

You can see and change your profile yourself on your profile page. Write to privacy@autolayoutai.com to get a copy of your data, to have it corrected, or to have your account and data deleted. GREPs that were published under CC BY 4.0 may already have been copied by others; we remove them from our site. You can unsubscribe from update notices with the link in any notice. If you are in the EU or the UK, you may also complain to your data protection authority.

Children

The site is meant for professionals. Please do not create an account or send us personal data if you are under 16.

Changes

If we change how we use your data, we update this page and the date at the top. For a significant change we tell signed-up members by email.