Privacy Policy

Last updated: April 25, 2026

The short version: Your documents never leave your device. We process everything locally in your browser. The only thing that touches our servers is your email address, your subscription status, and a count of how many pages you’ve redacted this month. We don’t see, store, or transmit the contents of any file you process.

What ZapRedact does

ZapRedact is a Chrome extension that finds and removes sensitive information (Social Security numbers, credit cards, medical record numbers, names, addresses, etc.) from PDF documents. All detection, redaction, and rendering happens locally in your browser using JavaScript and WebAssembly. Your files are read directly by the extension; they are never uploaded.

What we collect

Information you give us

Email address — required to identify your license. You provide this when you first sign in to the extension or upgrade to Pro.
Payment information — if you upgrade to Pro, your card details are collected and processed entirely by Stripe. ZapRedact never sees, stores, or has access to your card number.

Information we generate about your account

License key — a random identifier we mint when you create an account.
Subscription status — free, pro, active, past-due, or canceled.
Page count — the number of pages you have redacted in the current monthly billing period. We use this only to enforce the 5-pages-per-month free tier. We do not record which pages, what they contained, or anything about the documents themselves.
Account timestamps — when your account was created and last updated.

What we do NOT collect

The contents of any document you process.
Any text, images, or metadata extracted from your documents.
Filenames, file paths, or file sizes.
Browsing history.
Cookies for tracking purposes (we set no third-party tracking cookies).
IP addresses for analytics or marketing.
Device fingerprints, location data, or behavioral analytics.

How we use what we collect

To authenticate you when you sign in to the extension (email ↔ license key).
To enforce free-tier page limits.
To process subscription payments and manage Pro subscriptions.
To send you account-related transactional emails: welcome, subscription receipts, payment failures, cancellations.

That’s the complete list. We do not use your data for advertising, profiling, training AI models, or sharing with third parties beyond the service providers listed below.

Service providers

ZapRedact uses the following third-party services to deliver the product. Each one receives only the minimum data necessary.

Google Firebase — license records and account data are stored in Firestore. Cloud Functions process API requests.
Stripe — subscription billing and payment processing. Stripe receives your email and payment method.
Resend — transactional email delivery (welcome emails, subscription receipts).
Cloudflare — DNS and email forwarding for inbound support email.

Your rights

You can:

Access your data — sign in to the extension to see your email, plan, and current usage. Email support@zapredact.com for a full export.
Cancel anytime — click “Manage subscription” in the extension to open the Stripe Customer Portal where you can cancel.
Delete your account — email support@zapredact.com from the address on your account and we will delete your license record within 7 days.

Data location

License records are stored in the United States (Google Firebase, multi-region nam5). Email is sent from US-East-1 (Resend / Amazon SES). Stripe processes payments in the United States.

Children

ZapRedact is not directed at children under 13 and we do not knowingly collect data from anyone under 13.

Changes to this policy

If we make material changes to this policy, we will email everyone with an active account at least 14 days before the change takes effect. Minor edits (typos, link updates) we may make without notice.

Contact

Questions, requests, or complaints: support@zapredact.com. We answer every email.