US state privacy notice

In the last 12 months we collected the categories below, for the purposes in our privacy policy: answering messages, selling and supporting licenses, fixing errors in the app, securing and improving the website, and meeting legal obligations. In personal use we never receive the documents you redact; documents you share with your team reach us only end-to-end encrypted, and we cannot read them.

• IdentifiersName, email address, IP address, license keyYou; your browser; Lemon Squeezy; the app (IP address in error reports)Messages 24 months; orders as tax law requires
• Commercial informationLicense purchased, order date, countryLemon SqueezyAs tax and accounting law requires
• Internet activityPages visited, browser, performance data (only with consent)Your browserAggregated; up to 14 months
• Device and app informationError type and message, stack trace, app version, operating system, computer model and processor architecture, random installation ID, IP addressThe app (error reports)90 days
• Team sharing information (only if you use it)Account, organization, document and device identifiers, roles, device public keys and certificates, encrypted file sizes, times, document states and review decisions, a record of who did what, IP addressThe appEncrypted documents per your organization's retention setting (by default 30 days after export); the record of who did what is kept longer

We do not collect sensitive personal information as defined by the CPRA.

On macOS, Apple handles payment, your Apple Account, purchase and restoration through the App Store. StoreKit verifies the transaction; verified transaction metadata is stored in the macOS Keychain. Apple processes purchase and account information under its own privacy policy. The Mac app does not activate Lemon Squeezy keys. We receive neither your card details nor your Apple Account password. Apple.

On Windows, Lemon Squeezy is the reseller and merchant of record, acting as an independent controller for payment and billing details. We receive the name, email, country and order details needed to deliver and support the Windows license, and keep order records as tax and accounting law requires. Lemon Squeezy uses Stripe for card payments; we never receive card details. Microsoft Store purchases, when offered, are handled separately by Microsoft. Lemon Squeezy.

The app sends error reports to Sentry (Functional Software, Inc., USA), our service provider, to keep the app stable and secure. A report contains the error type and message (with file paths, quoted text, your home folder and user name removed), the stack trace, the app version, the operating system and its version, the computer model and processor architecture, a random installation identifier and your IP address, which Sentry receives with every report and may store with it. Reports never contain your files, document contents, the texts you redact or license keys.

Crash reports are always sent. Other reports are sent only while Settings > Privacy & data > Send diagnostics is on; it is on by default and you can turn it off at any time. Sentry keeps reports for 90 days. We do not sell this information or share it for cross-context behavioral advertising; Sentry uses it only to provide error reporting to us.

We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share data of consumers under 16. We disclose personal information only to the service providers listed in the privacy policy, for the business purposes described there.

This website honors the Global Privacy Control signal as a valid opt-out: when your browser sends it, analytics stays off and cannot be switched on. You can also review your choices at any time through “Your privacy choices” in the footer.

• Know and access the personal information we collected about you
• Delete personal information we collected from you
• Correct inaccurate personal information
• Receive a portable copy of your information
• Opt out of sale, sharing, targeted advertising and profiling (we do none of these)
• Limit the use of sensitive personal information (we collect none)
• Not be discriminated against for using any of these rights

Write to privacy [at] redactfirst.app or use the contact form with the topic “Privacy request”. We confirm receipt within 10 business days and answer within 45 days. To protect you, we verify a request by matching it to the email address we hold. You may use an authorized agent; we will ask for your signed permission and may confirm with you directly.

Appeals. If we decline a request, you can appeal by replying with “Appeal” in the subject. We answer appeals within 45 days (60 in Colorado). If you disagree, you may contact your state attorney general.

RedactFirst is a business tool. It is not directed at children under 13, and we do not knowingly collect their personal information.