Privacy Policy for MaskIt

Effective date: 2026-04-05

1) Privacy-by-design approach

MaskIt is a local-first redaction product. All text and file redaction runs in your browser session — including NLP model inference, which executes in a dedicated Web Worker thread. We designed the product to minimize server-side exposure of sensitive content.

2) Data we process in-browser

When you use MaskIt to redact text or files, the following processes run entirely client-side:

• Regex pattern matching for deterministic PII categories (email, IP, credit card, SSN, phone, UUID, IBAN, URL, SIRET, SIREN, date of birth).
• NLP inference using a multilingual BERT model for contextual entity detection (person names, organizations, locations). The model runs in a Web Worker with ONNX Runtime Web (WebGPU acceleration on supported browsers, WASM fallback otherwise) — no text is sent to any external API.
• PDF text extraction using pdfjs-dist (Mozilla PDF.js) for client-side parsing only; PDF bytes are not sent to MaskIt servers for parsing.
• Batch multi-file processing — when you upload multiple files, each is processed sequentially in your browser, still entirely local. Intermediate results for all files are held in browser memory.
• Human review — detection triage (approve, reject, defer, re-categorize) happens in browser memory and is not transmitted to our servers.

In normal operation, your raw document content never leaves your browser.

3) NLP model download

MaskIt uses the open-source model Xenova/bert-base-multilingual-cased-ner-hrl hosted on Hugging Face. On first use, the model binary (~30–50 MB quantized) is downloaded from Hugging Face's CDN and cached in your browser's storage. After download, all inference runs offline using WebGPU (on supported browsers) or WASM. MaskIt does not control or monitor the Hugging Face CDN. No document text is sent to Hugging Face or any other third party.

4) Data we collect and store

To operate the service, we store limited account and operational metadata on our servers:

• Account data: authentication/profile fields (email, display name) for sign-in and account management.
• Workspace and plan data: workspace membership, subscription plan/status, usage counters (scan count, character count, file count). Stripe billing linkage is stored in our database: stripe_customer_id is recorded on the subscriptions table (alongside subscription status and plan identifiers) for reconciliation with Stripe; we do not store full payment card numbers in application databases.
• Detection policy presets: category toggles and confidence thresholds — configuration metadata only, no PII.
• Job history metadata: file name, file extension, source type, entity counts by category, policy snapshot, processing duration, warnings, NLP usage flag, and timestamps.

Examples of stored job metadata:

Field	Sensitivity
File name	Low (but avoid putting PII in filenames)
File extension / source type	Non-sensitive
Entity counts by category	Non-sensitive (aggregated counts only)
Processing duration	Non-sensitive
Category summary	Non-sensitive (counts per PII type)

Important: Avoid putting confidential data directly in filenames, since filename metadata is stored for history and audit features.

5) Data we do not collect or store

• Raw document content (text bodies, file contents)
• Detected PII values (the actual sensitive strings)
• NLP inference inputs or outputs
• Review decisions (unless you explicitly export an audit bundle)
• Browser localStorage or session data

6) Data we do not sell

We do not sell your personal data to third parties.

7) Payments

If you purchase paid plans, payment processing is handled by Stripe. MaskIt does not store full card numbers in application databases. Payment metadata (subscription status, plan tier, and Stripe customer linkage on the subscriptions record) is stored for entitlement enforcement.

8) Analytics and history

The Analytics & History page displays aggregated statistics computed from job history metadata. These statistics (total scans, total entities, average latency, breakdown by PII type, activity trends) are derived from metadata only and do not contain or expose any PII from your documents.

9) Retention

• Browser processing state: redaction data, batch results, and review decisions in browser memory are session-scoped. They persist during your session but are cleared when you close the tab or navigate away (batch results persist during in-app navigation).
• Account/operational metadata: retained while your account/workspace is active, or as required for security, billing, and legal obligations.
• Job history: retention period depends on your plan tier (Free: 7 days, Trial: 30 days, Pro/Team: 90+ days).

10) Security controls (high level)

We use standard transport and platform controls provided by our infrastructure stack:

• HTTPS/TLS for all browser-to-server communication
• Row-level security policies on the database for workspace isolation
• Managed authentication via Supabase Auth
• Content Security Policy (CSP) headers restricting resource loading to known domains

11) Your rights (GDPR/CCPA-style requests)

Depending on your jurisdiction, you may request access to, correction of, or deletion of your account-related data. Because the product is local-first for redaction execution, server-side stored data is primarily account and operational metadata.

For requests, contact support through the contact form.

12) Policy updates

We may update this policy to reflect product or legal changes. Material changes will be posted with an updated effective date.