Privacy
Last updated: 25 September 2026
Your PDF never leaves your browser
This is not a promise about how we handle your file after receiving it. We never receive it.
RedactDrop is a static website: HTML, CSS and JavaScript files served from a CDN, with no application server and no database behind them. When you drop a PDF on the redaction page, the file is read by JavaScript running in your own browser tab, using the browser's File API. It is read with pdf.js and rewritten with pdf-lib, both running in your tab. The redacted PDF you download is assembled in memory and handed to your browser as a local blob: download. At no point is there any code on the page that sends the file, its text, the words you asked to remove, or anything derived from them anywhere.
The paid version does not change that. Buying RedactDrop Pro adds a payment and a licence key, and neither of them touches your document — the detail is under Paying for the paid version below. There is no route by which a document could be sent anywhere, and the browser is made to enforce it: the page's Content Security Policy does not let it connect back to this site at all.
How to check this yourself
- Open the redaction page.
- Open your browser's developer tools and go to the Network tab.
- Redact a PDF.
- No request appears carrying your file, its text, or the words you typed. The only requests are the page itself and its own files from this site. Nothing to do with payment is loaded unless you press a buy button.
What the page loads
Everything the redaction page itself needs is served from this site, including the PDF libraries — so reading and rewriting your PDF involves no other party at all. There are no fonts from another domain, no trackers, and no advertising.
| What | From | Why |
|---|---|---|
| Page, styles, redaction code | this site | To show the page and do the work |
| pdf.js worker | this site (/assets/vendor/) | To read the PDF |
| Google Analytics | googletagmanager.com, google-analytics.com | Not switched on. The page is allowed to load it, and loads nothing: there is no measurement id in /assets/config.js. Before it is switched on, this page will list every event it sends. |
| Paddle's checkout | paddle.com | Only after you press a buy button. Nothing from Paddle is loaded otherwise. Purchasing is not switched on yet. |
| The licence service | license.tekiba.app | Only if you have bought: to fetch your key after a purchase, and to check about once a month that it has not been refunded. |
| The licence service's test copy | tekiba-license-sandbox.metluno.workers.dev | The same two requests, against a sandbox copy used to rehearse a purchase without a real payment. Until RedactDrop Pro goes on sale, this is the one /assets/config.js names. |
A script this site does not use
Cloudflare, which serves this site, adds its own analytics beacon (static.cloudflareinsights.com) to pages it hosts. This site's Content Security Policy does not allow it, so your browser refuses to load it and it collects nothing. If you look at the developer console you will see it being blocked — that is the policy doing its job, and it is the same policy that stops this page sending your document anywhere.
Google Analytics, when it is switched on
After a purchase, Paddle sends you back to a page whose address carries your transaction ID, and that ID can be exchanged for your licence key. Google Analytics would ordinarily put the whole page address into its first event. So analytics refuses to start at all while a transaction ID is in the address bar, the ID is removed from the address before anything else runs, and that page is served with Referrer-Policy: no-referrer so the ID cannot travel to the next page either.
What that does not do, and we would rather say so than imply otherwise: the very first request for that page is made by your browser before any of our code runs, so the address — transaction ID and all — reaches the service that hosts this site in the ordinary way any web address does. We do not run a server and do not keep request logs of our own, but we cannot make a claim about our host's.
Paying for the paid version
Payment is handled by Paddle, who are the merchant of record. Your card details go to Paddle and never to this site — RedactDrop has no server to receive them and no form that could send them. Paddle is the data controller for what you give them: name, email address, billing country, card details and tax status. What they do with it is covered by Paddle's privacy policy. We can see that a purchase happened and its transaction ID; we never see a card number.
There is no account. You are not asked for an email address by us, there is no password, and nothing is stored about you on any server of ours — because we do not run one. What a purchase produces is a signed licence key, saved in this browser's local storage, and that is the whole of it.
What the licence service is sent, and when
| When | What is sent | To |
|---|---|---|
| Straight after a purchase, and again every couple of seconds until the key arrives or a minute passes | Your Paddle transaction ID (txn_…) | The licence service's /claim |
| If you paste a transaction ID in to get a lost key back | The same | The same |
| At most once a month, and only if you have a key | Your licence key | The licence service's /verify, to find out whether it has been refunded |
| Once more, straight away, if the licence service tells us the purchase this tab is looking at was refunded | Your licence key | The same, so that a refunded key stops working now rather than in up to thirty days |
That is every request the paid version can make. Nothing in the code that talks to the licence service can reach the redaction page, and nothing in the redaction page can reach your key: what passes between them is a single yes-or-no, in one direction. Checking a key does not use the network at all — the key carries its own signature and the page checks it offline.
The licence service keeps, per purchase, the transaction ID, the issued key and the date — no name, no email address, no card details, and nothing about what you redacted. It is a Cloudflare Worker with a key-value store and no other database.
Cookies and local storage
RedactDrop sets no cookies. It stores two things in this browser, in local storage, both readable and deletable by you, and neither ever sent anywhere except as the table above says:
| What | When | What is in it |
|---|---|---|
| Your licence key | If you buy, or paste a key in | The key. Removable from the button on the redaction page. |
| The date the key was last checked | With the above | A timestamp, so the key is not sent more often than once a month. |
While a purchase is being confirmed, the transaction ID is also held in session storage, so that closing the tab by accident does not lose it. Session storage is gone when the tab closes. “Remove the key from this browser” removes that too.
The words you type to be removed are never stored. They exist in the tab while it is open, and nowhere else.
Who runs this
RedactDrop is operated by Tekiba, an independent software project. We do not sell data, because we do not have any to sell. Questions about this page can be sent to [email protected].
Changes
If this page changes in a way that affects what leaves your browser, the date at the top changes and the change is described here.
25 September 2026. First version.