Your documents never leave your browser.

What runs your account, and measurements with no content at all:

• Your account: name, email address, hashed password, country and language
• Your plan and billing history, handled through Stripe
• Your detection settings: custom rules and profiles (patterns you define — never document content)
• Usage counters, with no content at all: how many documents, pages and masks, how many documents were refused at the daily limit, how many masks per category (names, numbers, addresses…), the file type (PDF, image…), whether the document is a scan, the country and language recognised in the document, your browser's language, and a token of the file name computed with the key that stays on your device — never the name in clear, never the content
• Your “not masked right?” reports: only the boxes you tick (a name, a number, an address…), with the document's country and language — never any text
• When a document fails (format refused, reading or OCR impossible, unreadable pages…), a technical diagnostic e-⁠mailed to our team and counted: the stage, the file type and size, the number of pages, the error name, the browser, the device and the language — never the file name or its content
• When you create your account, where you came from: the site page you saw first in the tab (home, pricing, a specific page or article — never its full address or parameters), the type of site you came from (search engine, AI assistant, direct link…), the campaign code of our own links if there is one, the time before you signed up and the method (email or Google). Nothing is written to your browser for this: the information stays in the tab, is sent with the sign-up or the “Continue with Google” click (already reduced to these categories), and is kept only if an account is created
• Your answers to the short questions we sometimes ask in the app or once by email (for example: how often do you have a document to anonymize? or, after a payment you did not complete: what stopped you?): the option you pick and the offer concerned, linked to your account, with your plan and how many documents you have already anonymized (in ranges) — never free text. Unsubscribing from emails of this kind is also recorded
• High-level technical logs (sign-in, errors) with no document data
• Without an account, on the trial page: to keep the daily document limit, the server derives a one-way fingerprint from your IP address and browser type, which changes every day. The application writes neither the IP address nor the fingerprint to its database or logs: the fingerprint stays in the server's memory and is forgotten when the day changes (midnight UTC) or on restart. The trial logs keep only counts and categories (file type, pages, masks, recognised country, scan or not, and, when something fails, the failure type, file size, browser and device). As for every page of the site, our host also keeps an access log (IP address, time, page requested) for about 30 days
• The tip e-⁠mails sent after sign-up or a purchase: the name of each step (for example "day 3") and its date, and your unsubscribe if you ask for it — so we never send the same message twice or write to someone who said no. Choosing a tip only reads these counters: documents anonymized and downloaded, plan