Privacy Policy

1. The short version

Your documents never reach us. The text inside them, every value AnoVeil detects, and the codebook that maps a placeholder back to a real value all stay on your own machine. We do not upload them, we do not hold a copy, and there is no mode in which we could read them.

What does reach us is the minimum needed to run an account: your email address, whether your subscription is active, and which device is authorised to run the application. That is the whole of it, and sections 4 to 7 list it field by field.

2. Who we are

AnoVeil is built and operated by an independent developer. Company registration is in progress, and the registered name and address will be stated here once it completes. Until then the contact point for anything in this policy, including a request under section 10, is hello@anoveil.com, which is read by the person who builds AnoVeil.

3. The part that matters most: your documents

AnoVeil is a desktop application. Detection, anonymisation, review and restore all run inside a local engine on your own computer, bound to the loopback address. The detection models are bundled inside the application rather than called over a network, and the interface loads nothing from a content delivery network.

None of the following is ever transmitted to us, by any code path:

• The text of your documents, or any part of it.
• Any value AnoVeil detects — names, addresses, account numbers, anything.
• Your codebook, which maps each placeholder back to the real value.
• Your custom vocabulary and your whitelist.
• File names, file contents, file sizes, or how many files you processed.
• Which findings you accepted and which you rejected at review.

This is enforced rather than promised. Our test suite blocks every non-loopback network socket, then runs a full scan, an anonymisation and a restore through the application. If any of them attempts to reach the network, the build fails. A second test deliberately breaks that block, to prove the block is real and not passing vacuously.

4. What we collect, and why

Your account

• Email address — to identify the account, confirm it is yours, send confirmation and password-reset messages, and contact you about the service.
• Password — stored only as a salted hash by our authentication provider. We never see or store the password itself. It is checked against known breach corpora at sign-up, so a password already exposed elsewhere cannot be reused here.
• Two-factor secret — only if you turn two-factor authentication on.
• Session cookies — to keep you signed in. They are strictly necessary. We set no advertising or analytics cookie on the account portal.

Your licence and your device

When the application activates or re-checks itself, it sends exactly four kinds of value and nothing else:

• A licence key, or a one-time activation link token — which subscription is being activated. A link token is single-use and expires after five minutes.
• An install identifier — a random identifier generated on your machine on first run. It is a random number with no meaning anywhere else, and reinstalling produces a new one.
• A device fingerprint — a salted, one-way hash of a few stable properties of your computer. Those properties are hashed and discarded inside the application and are never transmitted; only the hash leaves. It deliberately reads no disk serial, no network hardware address and no motherboard identifier. Its only purpose is that reinstalling AnoVeil on a computer you have already authorised does not consume another activation slot. A stable hash is still an identifier, and we treat it as personal data — but it is specific to AnoVeil and does not correlate with anything else your machine emits.
• A signed authorisation — the grant we previously issued, sent back so that it can be re-checked or released.

The application version travels in the request header. Nothing derived from a document — not a count, not a file name, not a category, not a detected value — is part of any of these requests. The licensing code cannot read the document engine at all: they are separate packages, and a test enforces that separation, so this is a structural property rather than a rule someone has to remember.

Automatically, as with any web request

• IP address and timestamp — received by our hosting provider when the application or your browser contacts us. Used to apply rate limits, detect abuse and keep the service available. We do not use it to build a profile of you.

5. What we do not do

We do not use advertising or tracking cookies. We do not run third-party analytics that profile you. We do not buy or receive personal data about you from anyone else. We do not sell or share your personal data. There is no automated decision-making with legal or similarly significant effects.

Fonts and stylesheets on this website and on the account portal are served from our own domains. They were previously fetched from a third-party font service, which disclosed your IP address to that service; that has been removed.

6. Bug reports, and the one case where content can leave

If you use the in-application report dialog and press Send, the report is transmitted. It contains the text you typed, optionally a short diagnostic block (application version, operating system, detection mode, and counts of how many times you have launched, anonymised and restored — no document data), and any screenshots you chose to attach.

A screenshot is the only way document content can ever reach us, and only because you attached it and pressed Send. The dialog warns you before it does. If you would rather not take that risk, the same dialog can write the report to your Downloads folder instead and transmit nothing at all. Please do not send us confidential documents by email either — describe the problem, or make up a small example.

7. Who else processes it

We keep this list short on purpose. Each of these does one job:

• Cloudflare — hosts this website, the account portal, the licensing service and its database, and provides the "verify you are human" check on the sign-up and sign-in forms. Processes your IP address, your account and licence records, and the device records described above.
• Supabase — provides account authentication. Processes your email address, your password hash, your two-factor secret if you enabled one, and sends the confirmation and password-reset emails.
• Basin — relays an in-application bug report to us by email, and only when you press Send. Processes whatever that report contains, including any screenshot you attached.

None of them is given your documents, your detected values or your codebook, because we do not have those to give.

8. Where it is processed

Our providers operate globally distributed infrastructure, so your data may be processed outside the country you are in. Where personal data is transferred out of the United Kingdom or the European Economic Area, the transfer relies on the standard contractual clauses or an equivalent safeguard set out in that provider's data processing terms.

9. How long we keep it

• Account and licence records — for as long as the account exists, then deleted when you delete the account, except where we are required to keep a record for tax or accounting purposes.
• Device authorisation records — until you revoke the device or delete the account.
• Bug reports — until the issue is resolved, and no longer than twelve months.
• Request logs — short-lived, and retained only as long as they are useful for rate limiting and abuse detection.

10. Your rights

Depending on where you live, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to receive it in a portable form, to object to or restrict how we use it, and to withdraw consent where our use of it rests on consent.

You can delete your account, and everything attached to it, yourself from the account portal. For anything else, write to hello@anoveil.com and we will respond within one month. If you are in the UK or the EEA and you are not satisfied with our response, you may complain to your national data protection authority.

11. Lawful bases

Where the UK GDPR or the EU GDPR applies, we rely on:

• Performance of a contract — for your account, your subscription and your device authorisations. We cannot provide the application without them.
• Legitimate interests — for rate limiting, abuse detection and keeping the service running, balanced against the very small amount of data involved.
• Consent — for a bug report, which is only ever sent because you pressed Send, and which you withdraw by not sending one.
• Legal obligation — for records we are required to keep.

12. Children

AnoVeil is a professional tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

13. Security

Traffic to our services uses current transport encryption. Passwords are stored only as hashes, by our authentication provider. The signed authorisation held on your machine is sealed using the operating system's own protection, and your codebook can be password-protected so that even someone holding your disk cannot read it. No system is perfect: if you believe you have found a vulnerability, please write to security@anoveil.com before disclosing it publicly.

14. Changes

If we change this policy in a way that materially affects you, we will say so by email to the address on your account and update the date at the top of this page. Continuing to use AnoVeil after a change means the updated policy applies.

15. Contact

Questions about this policy, and requests under section 10, go to hello@anoveil.com. Anything that looks like a data-handling vulnerability goes to security@anoveil.com.