Security

Updated 2026-11-03

The safest data is data we never receive. Your text and files are processed on your device; the rest is kept to a minimum and protected.

Your text never leaves the page

The scanner and the document engine run as JavaScript in your browser. The text, the files, their names and the traces found in them are not sent anywhere. You can check this in your browser’s developer tools: no request from the page contains your text — for the free limit it sends only a number of characters.

Account and sign-in

• No passwords to leak: sign-in works through one-time links that expire in 30 minutes (72 hours for the welcome email). Only a hash of each link is stored.
• The sign-in cookie is signed and HttpOnly. Signing out everywhere is possible on request.
• The free-limit record keeps only one-way hashes; your network address is not stored.

Payments

Card details go straight to Paddle and are never seen by us. Pro access is granted only after Paddle’s server confirms the payment with a signed event; the plan is taken from Paddle’s own price ID, not from anything the browser sends. Each payment can grant access only once.

The website

• HTTPS everywhere with HSTS.
• A strict Content Security Policy: no inline scripts without a one-time nonce, no third-party scripts except Paddle’s checkout on payment pages.
• The page cannot be framed by other sites.

Reporting a vulnerability

If you find a security issue, write to [email protected] with “Security” in the subject. Please give us reasonable time to fix it before making it public. We don’t pursue good-faith research that avoids harming users and their data.