TrulyRedacted

Legal

Privacy policy

Last updated: 7 October 2026

1. Who is responsible

The controller of personal data processed in connection with the TrulyRedacted website (https://trulyredacted.com) is [YOUR FULL NAME OR COMPANY NAME], [STREET AND NUMBER, POSTCODE CITY, COUNTRY], operating as an unregistered business activity (działalność nierejestrowana) under Polish law, e-mail: hello@rorvia.com. TrulyRedacted is a project of the Rorvia brand (rorvia.com).

2. In short

3. Your documents, images and videos

Opening files, text extraction, optical character recognition (OCR), the detection of personal data, face and license-plate detection, the inspection for hidden data (Document X-ray), redaction, verification and export are performed entirely by your own web browser (JavaScript, WebAssembly, Canvas and, for video, the WebCodecs API) on your device. The files you open, the findings, your custom term lists, the audit reports and the files you export are not transmitted to us or to anyone else and we have no access to them. If you open a password-protected PDF, the password is used only locally to open it and is never stored or transmitted. Because we never receive your files, we are not a processor of the personal data they contain within the meaning of Art. 28 GDPR, and no data-processing agreement with us is needed; you (or your organisation) remain the sole controller of that data and are responsible for reviewing the results before you share or publish them.

4. Data stored only on your device

To remember your choices, the application stores in your browser's local storage: detection settings and presets, redaction style, export options, custom term lists (only if you switch on "Remember these terms on this device"), the chosen language and the light/dark theme. The browser's cache (a service worker) may additionally keep the program files and the downloaded model files so that the application also works offline. This data never leaves your device and we have no access to it. Storing it is strictly necessary to provide the functions you explicitly use, so no consent is required (Art. 5(3) of the ePrivacy Directive and the corresponding Polish provisions). You can delete it at any time in your browser settings (site data). We do not set cookies.

5. Server logs

When you open the website, our hosting provider (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA - Cloudflare Pages) automatically processes technical data needed to deliver it: IP address, date and time, requested address, browser type and the referring page. Purpose: delivering the website and protecting it against attacks. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). The hosting provider processes the data on our behalf and keeps logs only for a short period unless needed to investigate an attack. The hosting provider is based in the USA; data is transferred on the basis of the EU-US Data Privacy Framework and standard contractual clauses.

6. Optional model files from third-party networks

The application is self-hosted. If a function needs a file that is too large for our hosting (currently files above 25 MB, for example an OCR language pack or a detection model), your browser downloads that file once from one of the following providers, only when you first use the function:

In doing so your IP address and basic browser information are transmitted to that provider, who may process them outside the European Economic Area (for example in the USA, on the basis of the EU-US Data Privacy Framework or standard contractual clauses). Your documents and videos are never transmitted; the model runs inside your browser. The downloaded files are cached by your browser for later offline use. Legal basis: performance of the function you requested (Art. 6(1)(b) GDPR) and our legitimate interest in providing it efficiently (Art. 6(1)(f) GDPR). Which files are self-hosted and which are downloaded on demand is listed on the legal notice page.

7. Links to other websites

The site contains links to other websites, including our other tools (SafeShrink, SafeAudio Studio, Scrinema) and a voluntary donation page (Buy Me a Coffee). We receive no personal data when you click them. After you leave our site, the privacy policy of the other website applies.

8. Contact by e-mail

If you write to us, we process your e-mail address and the content of your message to answer you (Art. 6(1)(f) GDPR), until the matter is resolved and then for the limitation period of possible claims. Please do not send us documents containing personal data of other people; we do not need them to help you.

9. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest. You also have the right to lodge a complaint with a supervisory authority, in Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the authority in your country of residence. Please note that we usually cannot identify you, because we do not store data that would allow it.

10. Other information

We do not sell data, we do not use automated decision-making or profiling and we do not require you to provide any data. The files you redact contain personal data of other people; you are responsible for processing them lawfully and for reviewing the automatic findings before publication - the application assists you, but it cannot guarantee that every item is found. We may update this policy when the service changes; the date of the latest version is shown at the top.

← Back to TrulyRedacted