Privacy Policy
Last updated: March 2026
PII Scrubbing Utility is a local-first tool — your text never leaves your browser. This policy explains exactly what (minimal) data we do collect and why.
TL;DR — The short version
We never see your text. Your documents, prompts, names, emails, SSNs, or any other personal information you paste into PII Scrubbing Utility are processed entirely inside your browser and are never transmitted to any server. The only data we collect is anonymous page-view analytics via Vercel — no cookies, no user IDs, no personal information.
What we collect
We collect anonymous, aggregate usage analytics via Vercel Analytics. Specifically:
- Pages visited and referrer URL
- Country of origin (derived from IP, IP is not stored)
- Browser type and operating system
- Device category (desktop / mobile / tablet)
We do not use Google Analytics, Meta Pixel, or any other advertising or tracking technology.
Your text and personal data
We never see, store, or transmit any text you enter into PII Scrubbing Utility.
All PII detection, masking, and rehydration runs locally:
- Detection engine — regex patterns and the BERT NER model both run 100% in your browser using WebAssembly. No text is sent to a server.
- Encrypted vault — the token↔original mappings are encrypted with AES-256-GCM and kept only in your browser's memory (JavaScript heap). They are never written to localStorage, IndexedDB, or any persistent storage.
- Session lifetime — the vault is permanently destroyed when you close or refresh the tab. There is no way to recover it.
The NER model binary (~30 MB, Xenova/bert-base-NER) is downloaded from Hugging Face on first use and cached by your browser. Only the model file is fetched — your text is never sent to Hugging Face.
Cookies and local storage
PII Scrubbing Utility uses no cookies for tracking or advertising.
We write one entry to your browser's localStorage:
- Detection settings (key:
pii-settings) — stores which PII categories you have enabled or disabled. Contains no personal data — only toggle states like{"EMAIL":true,"SSN":false}.
You can clear this at any time from your browser's developer tools or by resetting to defaults on the Settings page.
Third-party services
The only third-party services this app contacts are:
Vercel Analytics
Used for anonymous page-view analytics. Cookie-free, no PII, compliant with GDPR / CCPA / PECR. Data is processed by Vercel, Inc. (San Francisco, CA). See Vercel's Privacy Policy.
Hugging Face CDN
The NER model binary is downloaded from huggingface.co on first use. Only the model file (not your text) is fetched. Your IP address is visible to Hugging Face as the download source, the same as any CDN. See Hugging Face's Privacy Policy.
Tailwind CSS CDN
Stylesheet loaded from cdn.tailwindcss.com. No user data is transmitted — it is a static CSS file. See Tailwind's Privacy Policy.
Data retention
Because we do not collect personal data, there is nothing to retain or delete. The only data associated with your use of this service is anonymous, aggregate analytics metrics — these cannot be linked back to you and are retained by Vercel per their standard retention period.
Your detection settings (localStorage) persist until you clear them or reset your browser data. Your encrypted vault (in-memory only) persists until you close the tab.
Contact
PII Scrubbing Utility is operated by Upward Byte LLC. If you have questions about this privacy policy, please contact us via the company website.
This policy may be updated occasionally. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.