Last updated 16 August 2026
Your document is never uploaded to us. The redaction happens inside your own browser, on your own machine. We have no server in that path, so there is nowhere for your file to go and no copy of it for us to hold.
That is a strong claim for a tool people bring their most sensitive documents to, so here is precisely how it works, and how you can check it yourself rather than believe us.
You choose a file. The browser reads it, finds the text, applies the redactions, and writes a new PDF, all in the tab. Nothing is sent anywhere during any of it. You can watch this yourself: open your browser's network tab while you work and you will see no upload.
Close the tab and the document is gone from the page. We never had it.
A scanned page has no text to find, so the app reads it with optical character recognition. That recognition also runs inside your browser, using a WebAssembly engine and English language data that are served from this site and stored in the app itself.
This matters more than it sounds. Most OCR is a cloud service, and an OCR service would mean
uploading the exact pages you are trying to protect. Ours does not exist as a service. The app's
Content-Security-Policy is set to connect-src 'self' blob:, which means the browser
itself will block this page from sending data to any other host, whatever the code tries to do. It
is not a promise we are asking you to take on trust; it is a rule your browser enforces on us.
Most privacy policies have a paragraph here admitting to the one thing that does get uploaded. This one does not, and we checked before writing it: the application makes no network requests at all.
Even your licence key stays local. Licences are signed rather than looked up: we create the key offline with a private key, and the app carries only the matching public key and verifies the signature in your browser. No server is contacted to activate it, the app works with your machine completely offline, and we never learn when or how often you use it.
The trade: a check that runs on your machine can be removed by anyone determined to edit the app. We chose that over a server that would see every document you open.
Nothing about your documents. The app keeps a small amount of information in your own browser, which you can erase by clearing site data:
| What | Why |
|---|---|
| Your licence key | So you do not paste it every time. |
| A count of documents | To apply the free allowance. A number, nothing else. |
If you buy a licence, Stripe processes the payment and holds your billing details under their own privacy policy. We never see your card number. Your email address is used to send your licence key. It is not added to a mailing list and is not shared.
None on the page that handles documents. No third-party scripts run there. A script with access to that page could also reach your document, which would break the reason the product exists.
It removes text from a PDF and draws over where it was. It is not legal advice, and it does not know which parts of your document ought to be redacted. Checking the result before you send it remains yours to do, and the preview exists so you can.
If a page cannot be read at all, redaction stops and names the page. It does not return a clean-looking file and leave you thinking that page was checked.
If this policy changes, the date at the top changes with it. If a change ever made the statement at the top of this page untrue, that would be a different product, and it would be said plainly here and on the front page rather than buried in a revision.