Privacy policy

SafeRase (saferase.co) is run by Yudhish Condoor, an individual (sole proprietor) based in India. We decide how your personal data is used for the service, which makes us the data fiduciary (data controller) for it. Contact details are at the end of this page.

• We process a document only to find and redact the details you choose.
• Uploaded files are deleted after processing. Files kept for a review preview are removed within about an hour.
• Plain text files (.txt, .md) are redacted in your browser and not uploaded.
• We never use your documents or text to train machine learning models.

SafeRase can check text you paste on our site, or type in ChatGPT, Claude or Gemini with our browser extension turned on, and swap sensitive details for labels such as “Person A”.

• To find names and other details, the text is sent to our servers in India over an encrypted connection and checked. The result is returned and the text is not stored.
• We do not write that text, or the labels we find, to our logs. We keep counts and request identifiers only.
• The table that maps labels back to the real details stays on your device. Our server never holds the key to it.
• If the check cannot run, we tell you. We do not send your text to the AI tool for you without you knowing.
• SafeRase is not affiliated with, endorsed by or sponsored by OpenAI, Anthropic or Google. Once text reaches an AI tool, that company's own terms and privacy policy apply to it.

• It runs only on chatgpt.com, chat.openai.com, claude.ai, gemini.google.com and our own site, and asks for the browser's “storage” permission.
• It reads the text you type in the message box and the replies shown on those pages, only to find sensitive details and to restore your labels in replies. It does not read other pages or your browsing history.
• It reuses your SafeRase sign-in from our site so you do not sign in twice. It stores your settings and your encrypted label table in the browser.
• It uses what it reads only to provide these features. We do not sell it, use it for advertising, or use it to train models.
• Removing the extension removes its data from the browser.

To survive a crash or a sign-out, your label table can be encrypted in your browser and copied to our server for 5 minutes, then deleted automatically. We cannot read it. It is restored only if you choose to restore it, and it is deleted when you clear the session.

You can redact without an account. Your open files and choices live in your browser tab and are gone when you close it. To apply guest limits we use a random device identifier kept in your browser, which we store only as a one-way hash, and your IP address for a short time to stop abuse.

• Your email address, and your password if you set one. Passwords are stored hashed by our authentication provider, Supabase.
• For each signed-in session: your IP address, your browser and device type, and hashed session tokens. We use these to keep your account secure.
• Your plan and payment status.
• When you accepted these terms and this policy, and that you confirmed you are 18 or older.

If you choose Google, we ask Google only for your basic profile and email address (the standard openid, email and profile permissions). We use them only to create your account and sign you in.

• We do not sell Google user data, use it for advertising, or use it to train AI models.
• We share it only with the service providers listed below, to run SafeRase.
• Deleting your account deletes it. You can also remove SafeRase's access at any time from your Google Account permissions.

SafeRase's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Microsoft sign-in works the same way and shares only your basic profile and email.

We log that a redaction happened, the file name, type and size, and how many items of each kind were changed. We do not store the detected values or the document text in readable form. Authorised Saferase staff can see this activity record to run the service, give support and prevent abuse; their actions are logged.

• To provide the service you ask for: redaction, aliasing, your account and your plan.
• To keep the service and your account secure, and to stop abuse.
• To take payments and keep records that tax and accounting law requires.
• We use your data only with your consent for these purposes, or where the law allows. We do not sell it.

Payments are handled by Razorpay. We keep the order and payment reference, the plan, the amount and the dates it covers. The name, billing address and, if you give them, phone number and company you enter at checkout are sent to Razorpay with the order, along with the time you confirmed it. We never see or store your card or bank details. If you send an Enterprise enquiry instead of paying, the details and message you enter are emailed to our team so we can reply. See Refunds and cancellations.

• Sign-in cookies that keep you signed in. They are essential and set only when you sign in.
• In your browser's storage: your light or dark theme choice, the random device identifier described above, and, while you use the paste box, your encrypted alias list.
• A cookie banner asks before any analytics cookies are used, and remembers your choice.
• If you allow analytics, Google Analytics uses cookies to measure visits to this website. If you do not, it sets no analytics cookies and receives only limited signals without cookies, such as that a page was viewed.
• We also count page views with Vercel Web Analytics, which uses no cookies.
• We do not use advertising cookies.

SafeRase shows no ads and loads no ad scripts today. If that changes, we will update this policy first and ask for your consent before any ad cookies are used.

• Supabase: accounts, sign-in and our database.
• Razorpay: payments.
• Cloudflare Turnstile: a bot check when you sign in or sign up with a password.
• Upstash: short-lived counters that limit repeated sign-in and sign-up attempts, keyed by IP address or email and deleted when the time window ends.
• Vercel: hosting for this website, and page-view counts that use no cookies.
• Google Analytics: measuring visits to this website. It uses cookies only if you allow analytics in the cookie banner.
• Secure Privacy: the cookie banner, which stores your choice.
• Resend: delivering Enterprise enquiries from the checkout page to our team by email.
• An error-monitoring service, only if we turn it on: it receives the type of error and where in our code it happened, never your text or documents.
• Our own servers: they check text and files and hold the short-lived encrypted backup.
• Some of these providers may handle data in countries other than India.
• Google and Microsoft: only if you choose to sign in with them.

Documents and pasted text are processed in India. Some providers above may store or process data in other countries; when they do, they are bound by their contracts with us to protect it.

• Documents: deleted after processing; review previews within about an hour.
• Pasted text: not kept. Encrypted alias backups: 5 minutes after your last change.
• Redaction records (counts only): 90 days.
• Sign-in and security logs: one year, as Indian law expects for security records.
• Account details: until you delete your account.
• Payment records: as long as tax and accounting law requires.

• Download a copy of your data, or delete your account and its data, at any time from your dashboard.
• Ask us to correct or update your data, or to explain how we use it.
• Withdraw your consent by deleting your account. This does not affect what we did before you withdrew it.
• Name someone to act for you if you die or become unable to act.

Email privacy@saferase.co. We will respond within the time the law requires. If you are not satisfied with our answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

If a security incident affects your personal data, we will tell you and the authorities as Indian law requires, with what happened and what you can do.

SafeRase is not meant for anyone under 18. You must confirm you are 18 or older to create an account. We do not knowingly collect children's data, and delete it if we find it.

If we change this policy, we will update this page and the date at the top. For important changes we will tell you before they take effect.

Mohnish Condoor, privacy@saferase.co. Yudhish Condoor, an individual (sole proprietor) based in India.