BLACKOUT

Privacy Policy

Last updated: 15 August 2026

The short version

Your PDFs are never sent to us. Rendering, redaction, watermarking and OCR all run inside your own browser, so there is no copy of your document on our servers to secure, leak, subpoena or lose. The only personal data we hold is the email address you give Stripe when you pay, and the status of that subscription.

What happens to your documents

When you open a PDF in BLACKOUT, the file is read by your browser and stays there. Page rendering uses PDF.js, redaction and export use pdf-lib, and text recognition on scanned pages uses Tesseract compiled to WebAssembly. All three run as code executing on your machine, and the files they need are served from this site rather than a third-party CDN.

We do not upload, receive, process, log, store, cache or transmit your document, any page image from it, or any text extracted from it. Closing the tab discards it.

The file you download is a newly built document rather than an edited copy of yours, so the original's hidden properties do not carry over: author, title, subject, keywords and the name of the software that produced it are all absent from the export. The one exception is that the PDF library used to write the file records itself as the producer, which identifies our tooling and nothing about you or your document.

Requests the tool does make to our server carry no document data. Before a download it asks whether that download is covered by the free allowance or an active subscription; that request contains no information about the file. Starting checkout sends only which plan you chose.

What we store

  • Your email address, as given to Stripe during checkout, so we can tell whether your access is active and send an access-restore link if you ask for one.
  • Subscription status from Stripe — whether it is active, cancelled or past due, when the current period ends, and the Stripe customer and subscription identifiers.
  • Access-restore requests — the email address asked for, the time, and a single-use identifier for the link, so links cannot be reused and requests can be rate-limited.

We do not store your name, address, or card details. Card details go directly to Stripe and are never seen by this site.

Cookies

BLACKOUT sets two strictly necessary cookies, both cryptographically signed, both HTTP-only, and neither used for advertising or tracking across sites:

  • One records that this browser has used its free download, so the free allowance cannot be reset by clearing site storage alone.
  • One records that this browser belongs to a paying subscriber, so you do not have to re-identify yourself on every visit. It is re-checked against our records on each download rather than trusted indefinitely, which is how a cancellation takes effect.

Neither of those two requires your consent, because without them the service you asked for cannot be provided: one enforces the free allowance, the other is how your paid access is recognised.

Analytics and advertising

We use Google Analytics to understand how people find and use the site, and Google Ads conversion measurement to see which adverts lead to a purchase. Both set cookies and share data with Google, so both are optional and off by default.

Nothing belonging to Google is loaded until you choose “Allow” on the banner shown on your first visit. If you decline, or simply never choose, no Google script is requested, no analytics cookie is set, and no request is made to Google at all — we do not use the “consent mode” approach of loading the tag first and restricting it afterwards. Your choice is remembered in your browser's local storage and you can change it by clearing this site's storage.

What Google receives, if you allow it, is ordinary web analytics: pages visited, rough location derived from a truncated IP address, device and browser, and how you arrived. When you complete a purchase, the amount and plan are reported so an advert can be credited with the sale.

We also record which steps of the tool you reach — that a document was opened, that redactions were added and by which method, that a download was requested or the paywall was shown — so we can tell where people get stuck. These carry counts only: the number of pages in a document and the number of redactions on it, never a filename, a search term, a name you listed, or anything that was detected. No part of any document is ever involved — your PDFs are not uploaded to us or anyone else, so there is nothing about their contents for an analytics provider to receive, whichever choice you make.

Processors we use

  • Stripe — payments, checkout and the billing portal. Stripe receives your email and payment details directly and handles them under its own privacy policy.
  • Supabase — the database holding the subscriber records described above.
  • Resend — sends access-restore emails. It receives the recipient address and the link.
  • Vercel — hosting. Vercel keeps standard server request logs, which record that a request happened; the requests the tool makes contain no document data.
  • Google — analytics and advertising measurement, and only if you allow it on the consent banner. Receives the usage data described above, never document contents.

How long we keep it

Subscriber records are kept while your access is active and afterwards as needed for billing and accounting records. Access-restore request records are kept only to enforce single use and rate limiting. Ask us and we will delete your subscriber record; this cancels any access tied to it.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold, and to object to or restrict its processing. Since the only data we hold is an email address and subscription status, these requests are usually simple to fulfil. Contact us at the address below.

Contact

Questions about this policy, or a request about your data: privacy@blackoutredact.ink

← Back to BLACKOUT