euRedact Rules (Open Source SDK)

euRedact Rules runs entirely on your machine. No data is transmitted to any external server. We do not collect, store, or process any text you redact using the SDK. There is no telemetry, no analytics, and no network calls.

Website

This website (euredact.dev) is hosted on GitHub Pages, operated by GitHub, Inc. We set no cookies and use no third-party analytics. However, GitHub automatically logs technical data when you visit — including your IP address, browser user agent, and the pages you request — as part of serving and securing the site. This processing is carried out by GitHub as our hosting provider; see the GitHub Privacy Statement. Our legal basis is our legitimate interest in operating a secure, functioning website (Art. 6(1)(f) GDPR).

Browsing this website sends no data to third parties. Fonts, icons, and the map on our homepage are served from this website rather than from a content delivery network, and we do not use any IP geolocation service — the homepage code example is chosen from your browser's own language settings, which are never sent to us. The only request outside this site is to our own analytics server, described below; it is infrastructure we operate ourselves, not a third-party service.

The live demo runs entirely in your browser: it loads our open-source JavaScript package and redacts locally, so no text you enter into it is sent to any server.

Website Analytics

To understand which pages are useful, we run Umami, an open-source analytics tool, on our own infrastructure (analytics.euredact.dev). We chose it so that visitor data stays with us: it is not Google Analytics, and no analytics provider receives your data. Everything described in this section is non-personal data about how the website is used, collected for one purpose — improving the product and the site — and never to identify, profile, or advertise to you.

No cookies, no fingerprinting. Nothing is stored on your device and you are not tracked across sites or across visits.
No IP addresses stored. Umami derives an anonymous, rotating identifier from a hash of your IP address and browser, and discards the address itself. We cannot identify you from it.
What we record:the page you viewed, the site that referred you, your country, and your browser and device type — all in aggregate. We also count six actions: opening and submitting the waitlist form, running the demo, interacting with the homepage playground, running a redaction in it, and filtering the detection-coverage table. The demo event records only how many items were detected, never the text you entered; the playground events record nothing but the fact that you used it and how many times you pressed the button, never the text; the coverage event records only which filter you picked from the buttons on that page. We also label a visit as automated when it is obviously a bot — a self-identifying crawler or an automated browser — so that crawler traffic can be told apart from human traffic in our own statistics. That label is derived from your browser’s own properties and is not stored on your device.
We honour Do Not Track. If your browser sends a Do Not Track signal, nothing is recorded at all.
Legal basis: our legitimate interest in understanding how our website is used (Art. 6(1)(f) GDPR). As the data is aggregate and cannot identify you, we do not ask for consent, and there is no cookie banner.
Retention: aggregate statistics are kept for up to 24 months. They are never sold or shared.

Cloud Waitlist

If you ask for access to the euRedact cloud tier, we collect the email address you submit, the terms version you accepted, and any optional name, organisation or note you choose to provide. The blog no longer collects anything: new posts are published over RSS, which requires no address and creates no list.

Purpose: to assess and respond to your request for access to the closed alpha, and to notify you when the cloud tier becomes more widely available. We do not use your address for any other marketing, and we do not sell or share it.
Legal basis: your consent (Art. 6(1)(a) GDPR), given when you submit the form. You can withdraw it at any time by emailing us, with no effect on processing carried out beforehand.
Processor: none. Form submissions post directly to our own servers, hosted by Scaleway in Paris, France. Nothing you enter is sent to a third-party form service, and no signup data is transferred outside the EU. Until September 2026 this form was handled by Formspree, Inc. (United States); it no longer is, and no signup data remains with them.
Retention: until the cloud tier launches and we have notified you, until you ask us to delete your address, or after 24 months of inactivity — whichever comes first.

You have the right to access, rectify, erase, restrict, or port your data, and to object to processing. To exercise any of these, email us at the address below. You also have the right to lodge a complaint with your supervisory authority — in Belgium, the Data Protection Authority.

euRedact Cloud Closed Alpha

When the cloud tier launches, a separate privacy policy will detail how text is processed, what data is retained (if any), and what safeguards are in place. A Data Processing Agreement (DPA) will be available for all cloud tier customers.

Contact

For privacy-related inquiries, contact us at hello@euredact.dev.

Privacy Policy /