Privacy Policy
Last updated: 25 August 2026
Redact PDF is operated by Hugo Software ("we"). This page explains, in plain terms, what happens to data when you use redact.bnj.app.
Your documents never leave your browser
This is the core of the product, not a marketing line:
- The PDF you open is read, edited, verified and written inside your browser tab, using JavaScript and WebAssembly.
- Our servers have no endpoint that accepts a document. There is no upload, so there is nothing for us to store, read, lose or hand over.
- The verification step ("we reopen the file and search it") also happens in your browser, on the file that is about to be saved to your own disk.
- Close the tab and the document is gone from memory. We never had a copy.
The same applies to everything derived from the document: page images, extracted text, the words under your black boxes, the verification report.
What we do store
If you do not subscribe: nothing. No account, no email address, no cookie that identifies you.
If you start a subscription, our server stores one small row:
| Field | Why |
|---|---|
Licence code (BNJ-XXXXXXXX) |
Identifies your subscription without an account |
| Stripe customer id | Links the licence to the subscription at Stripe |
| Plan, status, period end | To answer "is this licence active?" |
We deliberately do not store your email address, your name, or any document-related data. Your licence code is also kept in your own browser's local storage so you do not have to type it again.
Payments
Payments are handled by Stripe. When you subscribe you are sent to Stripe's own checkout page; card details are entered there and never reach our servers. Stripe acts as an independent controller for payment data and holds the billing email you give them. See Stripe's privacy policy.
Analytics
We use Umami, a self-hosted, cookieless analytics tool running on our own server (uma.bnj.app). It records aggregate page views and anonymous events such as "a redaction was completed". It does not set advertising cookies, does not build a profile of you, and receives nothing about your document — not its name, not its size, not its contents.
There is no Google Analytics, no advertising SDK, no crash-reporting SDK, no social media pixel.
Stored in your browser (not on our servers)
- Language and light/dark preference
- Your licence code, if you have one
- Saved form-field layouts, if you save any
Clearing site data for redact.bnj.app removes all of it.
Where the little we hold is kept
The licence database runs on our virtual server in Germany (Hetzner). Stripe processes payments in the EU, the UK and the US under its own safeguards.
Your rights
Because we hold no personal identifiers beyond a licence code and a Stripe customer id, most requests are simple: write to the address below with your licence code and we can tell you what that row contains or delete it. Deleting the row cancels your access; cancelling the subscription itself is done through the customer portal or Stripe. If you are in the EU/UK you also have the usual GDPR rights (access, rectification, erasure, portability, objection) and the right to complain to your local data protection authority.
Children
The service is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially, the "last updated" date above changes and the new version is published here before it takes effect.
Contact
Hugo Software — [email protected]