Privacy Policy

RedactOnly and this website are published by Omnibus, Ltd (“we”, “us”), the controller of the personal data described here. Our full details are in the legal notice. For any privacy question write to privacy [at] redactonly.com.

• Documents you open in RedactOnly are processed only on your device. In personal use they are never uploaded to us or anyone else. When you share a document with your team, it is end-to-end encrypted on your device before it is uploaded, and we cannot read it (see “Team sharing”).
• A RedactOnly account is optional: redaction and purchases work without one, and only team sharing needs one. The app has no analytics and no advertising. It sends error reports that contain no files or document contents; apart from crash reports, you can turn them off.
• Connections cover Apple purchases on Mac, Lemon Squeezy license checks on Windows, error reports, optional signed rule template updates and, if you use it, team sharing. No document data is sent, except documents you share with your team, end-to-end encrypted.
• This website uses analytics only after you allow it, and never when your browser sends Global Privacy Control.
• We do not sell or share personal information, and we do not use it for advertising.

Opening, reading, text recognition, name finding, redaction, checks and reports all happen on your computer. Settings, rule sets, history and your trial start date are stored in the app's own preferences on your computer and are never sent to us.

On macOS, Apple handles payment, your Apple Account, purchase and restoration through the App Store. StoreKit verifies the transaction; verified transaction metadata is stored in the macOS Keychain. Apple processes purchase and account information under its own privacy policy. The Mac app does not activate Lemon Squeezy keys. We receive neither your card details nor your Apple Account password. Apple.

Windows: License checks. When you activate a key, the app sends your license key and a randomly generated device label, such as “Windows PC 3f9a”, to our license provider, Lemon Squeezy. It does not send your computer’s network name. Lemon Squeezy replies with an activation ID and the email address the license was bought with. About once every seven days the app confirms the key is still valid. Lemon Squeezy also receives your IP address, as with any connection.

Template updates. If you have a license and leave “Get template updates” on, the app downloads a public, signed file from our website at most once a day. The request carries no cookie, identifier or information about your documents; our server sees your IP address and the time, like any web server.

Team sharing is optional. It works only when you sign in with a RedactOnly account that is a member of an organization, and only for the documents you choose to share. Documents you do not share never leave your device.

End-to-end encryption. Before a shared document leaves your device, RedactOnly encrypts it there. The keys that open it exist only on the devices of the people it is shared with. We, our storage provider and anyone who gets into our servers cannot read shared documents, their titles, the boxes and suggestions marked on them, notes, review reasons, or what was found in them.

What is uploaded. For each shared document:

• the document and its redacted copies, as encrypted files;
• the document's keys, each wrapped (encrypted) separately for every device allowed to open it;
• its title, boxes, suggestions, notes and review reasons, encrypted with the document's key.

What our service sees. To store shared documents and control who may open them, our service handles: account, organization, document and device identifiers; members' roles; each device's public keys and certificate; the size of each encrypted file; times; the document's state (for example submitted, approved or exported) and review decisions; the number of changes; fingerprints (hashes) of the encrypted files and of the original document; signatures; and a record of who did what and when. Like any server, it also receives your IP address. Live cursor and selection updates between members are encrypted too, and are passed on without being stored. Notifications about team documents never include a document's title.

Who can open a shared document. Only the people it is shared with, on devices that you or an administrator of your organization approved. Owners and administrators of the organization do not get access automatically; if they give themselves access, this is recorded and shown to everyone on the document. Removing a member or a device stops further downloads at once, but cannot take back what someone has already seen.

Retention and deletion. Shared documents are kept for as long as your organization's retention setting says: by default, 30 days after the redacted copy is exported, or after the document is withdrawn or rejected. Then the wrapped keys and the encrypted files are deleted, which also makes any leftover copy unreadable. Deleting a document, the organization or your account follows the same path. On your device, team documents are kept only in an encrypted cache of the app, which is removed when your access ends.

Storage provider. Encrypted files are stored in private Cloudflare R2 object storage, a service of Cloudflare, Inc. (USA) that stores them for us as our service provider. Cloudflare holds only encrypted data and has no key to read it.

Your organization decides what is shared, with whom and for how long. We process this information to provide team sharing to you and your organization (GDPR Art. 6(1)(b)).

To find and fix bugs, the app sends error reports to Sentry, a service of Functional Software, Inc. (USA) that processes them for us as our service provider. A report contains the type of error and its message, with file paths, quoted text, your home folder and user name removed; the stack trace, which shows where in the app's code the error happened; the app version; the operating system and its version; the computer model and processor architecture; a random identifier for this installation of the app; and the IP address of your computer, which Sentry receives with every report, as with any internet request, and may store with it.

Crash reports are always sent: crashes, unexpected errors the app cannot handle, and errors it marks as critical. Other reports, such as handled errors and log messages that help us fix problems, are sent only while Settings > Privacy & data > Send diagnostics is on. It is on by default, and you can turn it off at any time; the change takes effect at once.

Error reports never contain your files, the content of your documents, the texts you redact, license keys, or your name or email address. Before a report is sent, file and folder paths and quoted text in error messages are replaced, and your home folder and user name are removed.

We rely on our legitimate interests in keeping the app stable and secure (GDPR Art. 6(1)(f)). Crash reports are needed to fix crashes; you can object to the other reports by turning Send diagnostics off. Reports are transferred to the United States under Sentry's data processing terms, which include the Standard Contractual Clauses. Sentry keeps reports for 90 days, its default retention period, and then deletes them.

Hosting and logs. The site is hosted by Vercel. Its servers process your IP address, browser type and requested pages to deliver the site and keep it secure (legitimate interest). These logs are kept for a short period by Vercel and are not used to identify you.

Analytics, only with consent. If you accept analytics, we use Vercel Web Analytics and Speed Insights, which count visits and measure performance without cookies, and, where enabled, Google Analytics. You can withdraw consent at any time through “Your privacy choices” in the footer. See the cookie policy.

When you write to us through the contact form, we store your name, email address, optional organization, topic and message so that we can answer you (legitimate interest, or steps before a contract if you ask about buying). New messages and anti-abuse request metadata are processed by our application backend and are available to authorized support staff. Earlier messages may remain in the legacy Cloudflare D1 store during migration, under the same retention policy. To block spam, the form uses Cloudflare Turnstile, which processes technical signals from your browser and your IP address; it does not use them for advertising. The mobile apps protect their account, support and contact forms the same way. Cloudflare's processing is described in the Turnstile Privacy Addendum, which forms part of this policy for these forms.

We keep messages for up to 24 months after our last exchange, then delete them, unless we need them longer to handle a legal claim. Please do not paste the content of sensitive documents into the form.

On macOS, Apple handles payment, your Apple Account, purchase and restoration through the App Store. StoreKit verifies the transaction; verified transaction metadata is stored in the macOS Keychain. Apple processes purchase and account information under its own privacy policy. The Mac app does not activate Lemon Squeezy keys. We receive neither your card details nor your Apple Account password. Apple.

On Windows, Lemon Squeezy is the reseller and merchant of record, acting as an independent controller for payment and billing details. We receive the name, email, country and order details needed to deliver and support the Windows license, and keep order records as tax and accounting law requires. Lemon Squeezy uses Stripe for card payments; we never receive card details. Microsoft Store purchases, when offered, are handled separately by Microsoft. Lemon Squeezy.

We use these providers, each bound to process data only for us or under its own policy:

• Vercel Inc. (USA): website hosting, logs, cookieless analytics
• Cloudflare, Inc. (USA): legacy contact storage (D1), spam protection (Turnstile) and storage of encrypted team documents (R2)
• Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging) (USA): delivery of team sharing notifications, which never include a document's title
• Apple (USA): Mac purchases and restoration (independent controller)
• Lemon Squeezy (USA): sales, tax, license keys (independent controller)
• Functional Software, Inc. (Sentry, USA): error reports from the app (processor)
• Google LLC (USA): Google Analytics, only if enabled and only with your consent

Some providers are in the United States. Transfers from the EU, UK and Switzerland rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise on Standard Contractual Clauses. Data about Canadian residents may be processed outside Canada and may be accessible to authorities there.

Depending on where you live you can access, correct, delete or export your personal information, object to or restrict its use, and withdraw consent. Details for your region:

• European Union, EEA, UK and Switzerland: see the GDPR page
• United States, including California: see the US privacy notice
• Canada, including Quebec: see the Canada privacy page

GDPR · US privacy notice · Canada. Write to privacy [at] redactonly.com; we do not charge for requests.

RedactOnly and this website are for work and are not directed at children under 16. We do not knowingly collect personal information from children.

Connections to this site, the license service, template updates, error reports and team sharing use HTTPS. Documents shared with your team are also end-to-end encrypted, as described under “Team sharing”. Access to contact messages is limited to the people who answer them. Read more on the security page.

If we change what the app sends or this site collects, we update this policy and its date, and describe app changes in the release notes.