Privacy and security
The short version
Your document is never sent anywhere. It is opened, read, searched and rewritten inside the tab you opened it in, by code that arrived with the page, and the finished file is written by your own browser onto your own disk.
This is not a promise about how carefully we look after your data. It is a statement that we never receive it, which is a different kind of claim and a much easier one to keep. There is no upload endpoint on this site to send a document to. You can watch the network panel while you work and see that nothing leaves.
What we collect
Nothing, through the tool. No account, no sign-up, no email address, no analytics, no cookies, no tracking pixel, no third-party script of any kind on the page that holds your document. Its content security policy forbids it from reaching anything at all, and that policy is served as a header as well as written in the page, so it cannot be quietly relaxed.
We do not know how many documents you have redacted, how long they were, what was in them, or that you used the tool today.
What is stored on your own machine
One thing: if you buy a pass, the pass itself is kept in your browser’s local storage so you do not have to paste it again. It is a short signed string saying that somebody bought a pass and when it expires. It carries nothing about who you are. You can clear it at any time by clearing this site’s data.
A draft is a file you download. It holds your marks and the words you typed, never the document, and it goes to your own disk like any other download. We never see it.
If you buy a pass
Payment is handled by Paddle, which is the merchant of record: they sell the licence, take the card details and handle the tax. We never see your card number. The name, email address and country you give at checkout are held by Paddle under their own privacy policy, and they are the ones who send your receipt.
Our own service that signs passes stores one row per purchase: the transaction id, the signed pass, when it was made and when it expires. Not your name, not your email address, not your country. Rows are deleted once the pass they describe has expired. That service has never been given a document and has no way to ask for one.
Checking a pass happens on your machine, against a public key that came with the page. Using one sends no request to us — so we do not learn that you exported a document, when, or what it was.
What our hosting sees
The site is served as static files by a hosting provider, and like any web server theirs keeps ordinary access logs: the IP address that asked for a page, the time, the file requested. That is the normal operation of a web server and we are not going to claim otherwise.
What those logs cannot contain is anything about your document, because the document is never part of a request. They record that somebody loaded a page, not what they did with it.
How the page is defended
A content security policy that allows no framing, no external script and no outbound connection, sent as a response header so it holds before the page is parsed. Strict transport security, so a browser that has been here once will not be talked back onto plain http. No third-party code on the tool page at all.
Buying happens on a separate page with a policy of its own, which is the only page on this site permitted to reach a payment processor. That separation exists so that the page holding a document has exactly the permissions it had before there was anything to buy.
The source is published. The claim that nothing is uploaded is one you should be able to check rather than take on trust, and you cannot check a program you cannot read.
What we could not do if we were asked
We could not hand over your document, because we have never had it. We could not tell anybody what you redacted, when you used the tool, or whether you have ever used it. There is no record to produce. This is a property of the design rather than a policy we have adopted, which means it does not change when our policies change.
We could not recover a document you lost, either. The same fact cuts both ways, and it is worth knowing before you close the tab.
Children
This is a tool for handling business and professional documents and is not directed at children. We do not knowingly collect anything from anybody, of any age.
Changes, and how to ask
If this page changes in a way that matters, the change will be visible in the repository’s history like every other change to this site.
Questions about any of it: [email protected].