Privacy

When you add a file on the check page, it is read by code running inside your own browser. It is not sent to us, because there is no server of ours that accepts files.

The checking runs in a background thread — a web worker — which keeps the page responsive and keeps your file in a part of the browser that has no connection to the network. The code that reads your file makes no network requests of any kind. That is a rule we enforce automatically: our checker library is tested and linted on the condition that it cannot make one.

If you close the tab, your file is gone. We never had it. Nothing is written to a disk, a database or a log anywhere on our side.

After a check finishes, we send ourselves one small, anonymous message so we know which detectors are earning their keep. It contains exactly five things:

• that the check came from the website (rather than the app or extension)
• the kind of file — “image”, “pdf”, “excel”
• which categories of thing we found — “gps_location”, “document_author” — but never what they were
• the overall risk level we showed you
• whether you downloaded a cleaned copy

It contains no filename, no file content, no previews, no hashes and no account identifier. There is no cookie attached to it. We cannot tie two of these messages together, or to you.

Your web server logs will record that your browser contacted us, including your IP address, in the ordinary way that every website works. We do not join that to anything else.

We can only report what we can detect. A result of no issues found means our checks did not match anything — not that a file is safe to share. We deliberately never use the word “safe”, because no tool can know what is risky in your particular situation.

Cleaning removes hidden data: metadata, comments, edit history, attachments. It does not rewrite the visible content of a document. If a card number is typed into a paragraph, we will point at it, but taking it out is your decision and your edit.