The privacy policy in full
ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India. Last updated 2026-09-03. Published at creasepoint.com/privacy, which is generated from this file rather than written beside it — there is one copy of each sentence here, and that is deliberate. This file also ships inside the application package, so the copy you were given and the copy on the website are the same bytes, and you can check that without asking us.
0. The uncomfortable things first
Three things are true that a privacy policy would normally bury, so they go at the top.
- We make a separate cloud product under the same brand. If you use that one, you are uploading your documents on purpose. This application is not involved in it, shares no code with it, and has no control that sends anything to it. We say this first rather than leave it for someone else to find.
- We cannot stop Windows reporting crashes to Microsoft, and a crash report can contain part of your document. We collect no telemetry of our own — there is no analytics, no usage counter, no phone-home. But Windows Error Reporting is part of the operating system, and publishing through the Microsoft Store shows us anonymous crash counts and stack traces. Neither is ours to switch off. And a crash report is not always just a stack trace: if the code reading your PDF crashes in a way Windows treats as memory corruption, Windows can take a dump of that process, and the process is at that moment holding your document. Your document's contents could travel in that dump. This is the one route by which anything from a document you opened can leave your machine, it is real, and §2 has the detail on what we do about it.
- One feature makes a network request, and only if you turn it on. See §3.
1. What this application collects
Nothing.
There is no account, no sign-in, no sync, no profile, no licence check, no usage analytics and no crash upload of our own. We do not know how many people use this application, which features they use, or that any particular installation exists.
The application itself never checks for an update. There is one way it can be updated automatically and you have to choose it: installing from our update manifest rather than from the package. That is Windows checking, once a day, whether a newer version exists — the same mechanism the Microsoft Store uses, with the URL written in the file you installed from. It tells us nothing about you beyond what any web server sees when something requests a file, and it does not run at all if you installed the package directly. We would rather describe it than let you find it.
There is no code in this application that makes a network request. The build asserts this: a test reads the compiled assemblies' reference tables, and a second reads the native import tables, and either fails the build if networking appears where it is not declared.
You do not have to take our word for that test. An .msix is a zip file. Unzip the one you installed, run dumpbin /imports over what is inside, and read the answer off the binaries you were actually given rather than off a promise about a build you did not watch. That is how we found the one entry we had wrong: tesseract.dll imports a name-resolution function, third_party/README.md used to say it imported none, and the document was corrected rather than the sentence softened. The single exception that is by design is the separate helper program described in §3.
2. What happens to your documents
They stay on your machine.
Every document you open is parsed in a separate, confined process on your own computer. Nothing is uploaded to us, queued, cached remotely, or retained by us in any form. We never see your documents, their names, their contents or their number.
Nothing is written until you say so. Editing happens in memory: rotate a page, fill a form, add a signature, and the file on disk has not moved. When you save, you choose whether that replaces the document you opened or writes a copy, and the application says which it is about to do. There is no autosave, because an autosave would write to a file you had not chosen yet.
Test it rather than believe it. Turn on airplane mode. Every feature still works, with the one exception below.
The exception we cannot close, stated plainly. The reason your document is parsed in a separate process is that PDF parsers are where memory-safety bugs live, and a malformed file is the classic way to trigger one. When that kind of crash happens, Windows can write a dump of the crashing process and send it to Microsoft, and that process is holding the document it was reading. The crash-handling opt-outs an application can set do not survive this particular kind of failure — that is documented behaviour of the operating system, not a setting we forgot. What confinement buys is that the process in the dump is a minimal one that holds one document and nothing else: not your other open files, not the rest of the application. It does not buy immunity, and we are not going to describe it as though it does. This goes to Microsoft under Microsoft's policy; it never goes to us.
3. The one exception: timestamping a digital signature
When you add a digital signature to a document, you may optionally ask a public time authority to attest the hour it was signed. That is a genuine network request, and it is off unless you choose it.
When you do choose it:
- A separate program,
Creasepoint.Timestamp.exe, makes the request. It is the only code we wrote that opens a network connection, and it runs in its own short-lived process that exists only for the length of the request. The package also carries the .NET runtime and the Avalonia user interface framework, and those include networking libraries we never call — System.Net.Http.dll and around twenty siblings. If you unzip the package you will find them, so we would rather tell you than have you discover it. What we can say, and what the build checks, is that none of our own code refers to them. - It sends an RFC 3161 timestamp query, which contains a cryptographic hash of your signature. It does not send your document, any part of its content, or its name. A hash cannot be turned back into the thing it was computed from.
- It sends no cookies, follows no redirects, and gives up after 20 seconds.
- It goes to the time authority you choose. The application offers a short list of public ones and selects none of them for you: the box is empty until you pick or type an address. That was a deliberate change — it used to arrive pre-filled with DigiCert, which meant the sentence above would have been describing a choice we had made on your behalf.
- Whichever authority you choose is a third party. It is not us, what it logs is its policy and not ours, and it will typically see your IP address and the time of the request, as any web server would. If you pick one of the two we list, see §5.
- The request travels over plain HTTP, because that is what the public RFC 3161 services listen on — we checked, and DigiCert's does not answer on port 443 at all. It matters less than it looks: the authority's reply is signed, so nobody on the path can forge a timestamp. What an observer on your network can see is that you asked a timestamp authority for one, and roughly when. If that matters to you, leave the box unticked, or point it at an authority inside your own organisation.
If you never sign a document, or you sign without the timestamp option, this program never runs.
4. What we do not claim
We do not claim this application cannot reach the network. Windows does not let an ordinary desktop application permanently surrender network access, and a claim we cannot enforce is worth nothing. What we claim instead is narrower and still worth something: there is no code in this application that makes a network request, and the build asserts it. The source is not published, so that assertion is our word rather than something you can run. What you can do without us is the airplane-mode test below, and reading the import tables in the package you were given - where you will find that tesseract.dll imports getaddrinfo through a dependency of the OCR stack. No OCR feature reaches it, and an import is not a call. Better you read that here than find it yourself.
There is no Android application yet, and this policy is about the Windows one. An earlier version of this paragraph described Android privacy properties in the present tense. That was wrong twice over: there is nothing released to have those properties, and the enforcement claim inside it had never been measured on a device. When a mobile application ships, it gets its own policy, written from what that build actually does.
5. Third parties
We use no analytics provider, no advertising network, no crash-reporting service, no content delivery network and no cloud storage in this application. We share nothing with anyone, because we have nothing to share.
The one third party the application can contact during normal use is a timestamp authority, and only if you turn the timestamp on and choose one. The two the application offers are:
- DigiCert (
timestamp.digicert.com) and Sectigo (timestamp.sectigo.com) — public RFC 3161 services that need no account. Whichever you pick receives a hash of your signature and sees your IP address and the time. It does not receive your document or its name. You can replace either with any RFC 3161 authority, including one your organisation runs; nothing is chosen for you.
Distribution channels have their own policies we do not control:
- Microsoft Store — Microsoft handles the download and shows the publisher anonymous crash counts. See Microsoft's privacy statement.
- GitHub — if you download a release directly, GitHub sees the request.
6. What Windows does that we do not control
Everything above is about what this application does. Windows does things of its own to any document open on the screen, and none of them is ours to switch off. Naming them is more useful than a claim that quietly assumes them away.
- Windows Recall, on Copilot+ PCs, takes periodic screenshots of the screen and indexes them. It is off unless you turn it on, and it is a feature of the operating system rather than of any application. If it is on while you have a document open, the operating system has a picture of that document.
- Clipboard history and Cloud Clipboard. Text you copy can be kept in Windows' clipboard history and, if you have that syncing turned on, sent to your Microsoft account.
- Microsoft Defender sample submission, on by default, can upload a file it finds suspicious to Microsoft for analysis.
- Windows Search indexes the contents of files in indexed locations, including anything you save.
- OneDrive folder backup silently syncs Desktop and Documents on many machines, so a file you saved "locally" may be in the cloud because a setting elsewhere says so.
We are not going to describe any of these as our failure or as something an application can prevent, because neither is true. They are listed because someone comparing what this policy says against what their machine actually does deserves to find the list here first.
7. Children
This application has no accounts, no user-generated content and no communication features, and collects nothing from anyone of any age.
8. Your rights
Data-protection law gives you rights of access, correction, erasure and portability over personal data a company holds about you. We hold none, so there is nothing to access, correct, erase or port. This is not a refusal — there is genuinely no record of you.
If you believe otherwise, write to us and we will look.
9. Changes
A change that weakened any statement above needs a superseding entry in the project's decision log, which is append-only: entries are superseded, never edited, so a claim that was quietly walked back leaves both versions behind. That is a deliberately awkward process, because the ability to quietly weaken a privacy policy is the thing this project most wants to deny itself.
And you can check it without us. This file ships inside the application package. Keep the .msix you installed, and when a new version arrives, unzip both and compare this document. A weakening is then a diff you hold, not a promise we make about our own record-keeping.
ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India — [email protected]
If that address bounces, write to the registered office above — ARHAS INDIA (OPC) PRIVATE LIMITED is a registered Indian company, CIN U62013TS2026OPC220112, and its address is a matter of public record with the Ministry of Corporate Affairs whatever happens to a mailbox.
Publishing an address that does not receive would be a small dishonesty of exactly the kind the rest of this document exists to avoid, and this project has done it once before (SECURITY.md, and DECISIONS.md #036). That is why the fallback here is a company registration rather than a second address that could go the same way.
Security issues have their own route: see SECURITY.md.