Your files, your privacy

Checking and preparation run on your device. Selected photographs, documents and sampled camera frames are not uploaded for processing. Pending finished files are encrypted in browser storage. Our server stores output metadata and an encrypted key; purchase access is checked before that key is released. If you choose to transfer a file between devices, using a pickup code or the phone camera link, it is encrypted before upload. Our server receives the encrypted file without its decryption key.

You can check a photo, prepare a file and buy a single photo or PDF without an account. Guest checkout is available for one person. A free account is required for two or more people. An account keeps purchase history. For a guest purchase we keep the Stripe receipt email so you can recover access to the purchased outputs with a one-time link. We use Google Analytics only if you choose to allow it. It measures visits to public information pages. We do not send it your photographs, documents or form contents. We do not run advertising scripts.

Face and document checks, cropping, background preparation, scanning and compression run in your browser. Processing downloads our code and local models, but does not upload selected files or camera frames. Site-help questions and conversation context are also processed locally. No processing consent upload step is required.

To protect normal unpaid downloads, we exchange public encryption keys and send only the finished output’s digest, service, file type and size to our server. File contents remain on your device. Pending keys expire after six hours; keys for checkout are retained for up to seven days. The key is released only after purchase verification. Processing code and pixels necessarily exist in your browser, so on-device processing cannot guarantee that a determined visitor cannot inspect the engines or intercept their own result.

Your browser can keep originals and page scans for recovery. We ask before restoring them. Each saved copy expires after six hours and is removed when you next use the site. Start again clears the current draft; another open tab can keep its copy. Clearing site data or using the button below removes the local files immediately.

A pickup code is optional, and it exists so you can prepare a file on a laptop and collect it on the phone you are filing from. The phone camera link also transfers files: it sends a photograph or scanned page from your phone to the browser where you are preparing it. Both use the same encrypted transfer service.

For either transfer, the file is encrypted on your device with AES-GCM using a key derived from the transfer code. We receive the encrypted bytes, a one-way hash used to find the parcel, the file name, the file type, and an expiry time. The key never reaches us, so we cannot read the file, and neither can anyone who obtains our database.

A code lasts 7 days or 10 retrievals, whichever comes first — a retrieval being one entry of the code, not one save of the file — after which the file cannot be retrieved and the encrypted bytes are removed by cleanup. Anyone holding the code can collect the file, so treat it like a password — do not put it in an email subject line or a public post. Guessing is rate limited. We cannot recover a lost code, and we cannot recover the file without it.

For one person, an account is optional, including orders with several prepared PDFs. A free account is required for two or more people. Accounts retain purchase records and, with permission, finished encrypted file copies.

Signing up with an email address stores that address, a name if you give one, and a hash of your password — never the password itself. Signing in with Google stores the same basic profile Google returns (name, email address, avatar URL); we never receive your Google password, and we ask for nothing beyond your identity.

Creating an account alone does not start file processing or account saving. Your account keeps names and file records. If you enable “Save finished files to my account,” unlocked outputs are also saved as described below.

A password reset sends a single-use link to your email address, valid for one hour. Request account deletion from Account settings. Confirm using the emailed link while signed in. This deletes account details, sessions, people, saved files, file metadata, purchase access and history tied to that account. Paid transaction references, amounts and dates are retained without your name or email for financial reporting; Stripe keeps its own records separately.

Enable “Save finished files to my account” to save future unlocked outputs automatically. We upload only the finished photo, PDF or print sheet, together with its filename, application specification, size and payment reference. Original photographs, raw page scans and unfinished edits are not uploaded by this feature. Older files remain local until you choose “Save files from this browser.” A record of an older file cannot recreate its bytes.

Account copies are transferred over HTTPS and encrypted in our database with AES-256-GCM. Unlike pickup-code transfers, our server holds the encryption key so it can return a file after verifying your account session. This is not end-to-end encryption. The files are available only through your signed-in account; there are no public file links, and file contents are never sent to analytics.

Account storage is limited to 100 files and 100 MB total, with a 20 MB limit per file. Completed files have no automatic expiry and remain until you delete them from Saved files or delete your account. Turning saving off stops future uploads and cancels incomplete ones; it does not delete existing saved files. Incomplete uploads are unavailable and expire after 24 hours and are removed the next time you save files to that account. Deleted files leave the active database immediately; infrastructure backups may retain encrypted copies according to the host’s backup schedule. Keep a downloaded backup of important documents.

Payments are processed by Stripe. Your card details are entered on Stripe's own checkout and never touch our servers or our code — we never see, receive, or store a card number.

We send Stripe the amount, the item you are buying, and an internal checkout reference. We never send Stripe your photograph or document. Stripe acts as an independent controller of the payment data it collects, and its own privacy notice governs that.

For a guest purchase, Stripe returns the receipt email to us and we store it with the checkout. If you ask to recover a purchase, we use it to send a random, one-time link that expires after one hour. We store only a hash of that token. The link restores remaining purchase proof to your browser; it cannot restore or reveal a photograph or document.

• Typefaces and face-detection model. Both are served from our own site; loading them does not contact Google or another model provider.
• Stripe. Only when you choose to pay, and only as described above.
• Google. Only if you choose to sign in with Google, and only to confirm who you are. Never for your files.
• Contact-form spam check. Your browser solves a small proof-of-work challenge that our own server verifies. It uses no tracking cookies and sends no data to a CAPTCHA provider.
• Resend. Delivers account and purchase-recovery emails. If you use the contact form, it also carries your reply address, chosen topic, optional page or step, and message to our private support inbox.
• Our own server. Serves the site, and stores encrypted files when you use a pickup code or phone camera link. Standard web server logs may record IP addresses and requested pages for security and troubleshooting.

Links to official government portals are plain links. Following one takes you to a site with its own privacy practices, which we do not control.

Google Analytics is optional. We do not load its tag or send data to Google until you choose “Accept cookies” or enable Analytics in Cookie settings. If you choose “Essential only,” the site works the same way. You can change analytics and referral tracking independently with “Cookie settings” in the footer. Essential cookies always stay on. We record page views only for public information pages, without query strings. We do not send upload contents or form contents.

New visitors see a cookie choice in every region. Essential cookies are used only as needed for sign-in, payments and security and cannot be switched off through the site. Optional analytics is off until accepted. We remember your cookie preference in browser storage for six months, then ask again. Turning analytics off stops measurement and removes its cookies. Another browser has its own cookie choice.

• Optional analytics cookies. If you allow analytics, Google may set first-party _ga cookies to distinguish visits. They expire 28 days after your first opt-in. Turning analytics off removes them from this browser. Google processes the visit data under its own privacy terms.
• Optional referral storage. If you choose “Accept cookies” or enable Referral tracking in Cookie settings, we remember a creator’s referral code on this device for 30 days. A later consented referral link replaces the earlier code. Declining or withdrawing this option removes it. Link attribution is sent to checkout only with current permission. A code you explicitly type at checkout is functional order state kept for the browser session. Codes are not sent to Google Analytics.
• Referral commissions. A valid, configured code is associated with a purchase to credit the referring partner. We record the code, partner, checkout reference, currency, payment excluding tax, refunds and the recorded commission rate. We exclude identified self-referrals. No applicant file or form content is shared with the partner. Financial attribution already recorded for a purchase is retained with its accounting records; withdrawing referral-link permission stops future link attribution. Your own account shows your earnings and payout history. Influencer payout setup shares your account email and selected country with Stripe when you choose to continue. Stripe collects bank and identity information on its hosted pages; we retain recipient and transfer references, amounts, currencies, quoted conversion rates, fees and statuses.
• Customer referral rewards. We record the referring account, qualifying checkout, reward reservation and use, and a one-way digest of the verified buyer email to enforce the first-purchase and five-person limits. This digest is still treated as personal data. Referrers see counts, without their friends’ contact or document details. Account deletion disables its codes and removes its commission contact email; financial references remain with the accounting records.
• Limited launch offer. We record the checkout, offer reservation and use, and one-way digests of the account’s verified email addresses to enforce one paid use per customer and the 100-customer limit. These digests are personal data. They remain with the offer and accounting records after account deletion so creating another account with the same verified email does not reset the allowance.
• Sign-in cookie. Set only when you sign in, to keep you signed in. It lasts up to seven days, is renewed while you use the site, and is removed when you sign out.
• Sign-in step cookies. While you sign in with Google, a passkey or two-step verification, short-lived cookies confirm that each step comes from the same browser. They expire within minutes.
• Preview access cookie. Only while the site is closed behind a preview password: it remembers that you entered the password, for 30 days.
• Browser storage (not cookies). Your place in an application, your currency and filing-country choices, purchase proof and records of files you paid for, and a checkout in progress are kept in your browser's local and session storage. Work-in-progress files can be restored from its database storage for six hours. Expired copies are removed when you next use the site. None of this is readable by other sites, and clearing this site's data in your browser removes it.

• Device preparation: local originals and processing recipes expire after six hours. Encrypted pending outputs expire after seven days. Expired copies are removed when you next use the site; clearing local site data removes them immediately. Escrow keys expire after six hours, extended to seven days for checkout, and are removed during cleanup. Files prepared by the previous server-processing release remain available only for their existing expiry; no new processing media is accepted. Downloaded copies remain wherever you save them.
• Encrypted transfers: pickup files and phone camera transfers expire after 7 days or 10 retrievals. Expired files cannot be retrieved and are removed by cleanup. Our server does not hold their decryption keys.
• Your progress through the steps: in your browser's local storage.
• Guest purchase proof: in your browser’s local storage. We keep the checkout, its selected output identities and receipt email so access to those outputs can be recovered by email. This proof contains no source documents.
• Account details, if you create one: your email address, optional name, and a password hash (or the basic profile Google returns), kept until you ask us to delete the account.
• Support messages: the contact form does not add them to our application database. Resend delivers the reply address and message to our support inbox, where they are kept only as long as needed to answer, investigate, or meet a legal obligation.
• Payment records: held by Stripe under its own retention rules, and by us as the minimum transaction record tax law requires. Unused purchase-recovery tokens expire after one hour; a newer request invalidates an older unused token.

Processing files stay on your device. Pending outputs are encrypted locally; their key release is checked against the exact paid purchase on the server. Optional transfers between devices use separate encryption whose key stays with your pickup code.

Account sessions are held in secure cookies, and sign-in and recovery are rate-limited. Stripe-signed payment notifications are verified before purchase access is confirmed. Keep your password and email account secure, and sign out on a device you do not control.

To report a weakness, use our contact form and choose “Security concern”. Include the affected page, what you observed and safe steps to reproduce it. Do not include real passport images, passwords, full card details or other people’s personal information. Please give us a reasonable opportunity to investigate before publishing details; we will acknowledge a credible report and keep you updated.

No online service can promise that incidents will never happen. If you believe your account or payment has been affected, contact us promptly.

You can remove local files and unfinished work with the button below. This does not delete account copies, pickup transfers or payment records. Delete saved account files from Saved files, or request account deletion from Account settings.

Where the UK GDPR, the EU GDPR, India's Digital Personal Data Protection Act, or a comparable law applies to you, you have rights of access, correction, erasure, and complaint to your supervisory authority. For an encrypted pickup parcel we can delete a parcel if you give us its code — without it we cannot identify which parcel is yours, and it expires by itself within 7 days regardless.

For anything else, or to raise a concern, use our contact form. It sends the request to a private inbox without publishing that address. Our controller details are:

A passing check means the file met that recorded measurement. The source and date show where the published guidance came from and when we last checked it. Some checks use preparation targets or instructions you supplied. A pass does not guarantee acceptance of your file or application.

Always open and check a prepared file before you submit it — the terms and disclaimer set out what to look for and why this matters.