Follow the document. Check the safeguards.

On your machine, and nowhere else. Detection and anonymization run locally. Unplug the network: everything keeps working.

No document, no excerpt. The first launch downloads the engine once (from our distribution space, GitHub) and the detection models (Hugging Face). On activation, your email address. Then a license check at each launch, as described below.

One thing goes on its own: at launch the app checks its license and sends its version, its system and an install identifier. We keep the date, so we know which versions are still running. Nothing else: no tracker, not a file, nothing about what you anonymize. After a crash, the app offers to send a report. It carries no document and no file name, you read the text first, and nothing leaves without your click.

The license email and, at activation, the date, the operating system and the app version. No hardware identifier, no content. The detail is in the privacy policy.

The mapping between fake name and real data is encrypted with AES-256-GCM, using a key derived from your passphrase via Argon2id. Without the passphrase, no one decodes it. Not even us.

The detection models are open (MIT, Apache-2.0), published on Hugging Face. You can see what reads your documents. The application itself is not open source, and doesn't claim to be.

Yes. Every update is verified by signature (minisign) before installation, and the macOS app is signed and notarized by Apple (Developer ID). On Windows, code signing is coming.

Each run produces a report generated locally: categories, counts, exclusions, SHA-256 fingerprint, version. No personal data inside. A trace to archive.