Policy
Privacy
StillReadable is built so that the interesting data — your files and what they leak — never reaches us. This page lists everything the server does see, and everything it never can.
What this site sees
- Page views, counted without cookies. Vercel Web Analytics records that a page was visited — no cookies, no cross-site identifiers, no profile. Custom events carry event names only, never file contents, file names, or findings.
- At purchase: Stripe, and only then. Paying happens on Stripe’s own checkout page. Stripe receives your payment details and email address; this site never sees your card. When Stripe sends you back, the site receives the Checkout session id and uses it server-side to confirm the payment and mint your license.
- If you restore by email. Restoring a purchase with your email and card last-four sends those two values to the server once, to look up your payment with Stripe and re-issue your license. They are not stored.
What this site never sees
- Any file you scan or clean. Files are read inside your browser by a Web Worker and never uploaded. There is no endpoint that accepts them.
- Any finding. What your documents leak is computed and shown on your machine, and stays there.
This is enforced, not promised: the Content-Security-Policy sent with every page blocks connections to anything but this site, which you can verify in your browser’s network panel — or by going offline and scanning anyway.
Where your license lives
Your Pro license token is stored in your browser’s localStorage, on your device, and nowhere else. There are no accounts and no database. Clearing your browser data removes the token; your license key or your Stripe receipt restores it on any device.
Questions
Email hello@stillreadable.com.