Privacy
Last updated 15 August 2026. Written to be read rather than to be defensible.
Your documents never leave your device
The comparison engine runs on your own machine — in your browser as WebAssembly on the web, and locally in the desktop application. When you compare two files, neither file is uploaded, and no part of the result is transmitted. This is not a policy that could be changed quietly: an allowlist compiled into the application refuses every destination that is not on it, and a test runs the desktop build behind an intercepting proxy and fails the build on any request outside that list.
Documents leave your machine only when you deliberately send them somewhere: to your own iManage tenant, or to an AI provider you configured with your own key. Both are your systems, not ours.
There are no accounts
The public product has no sign-up, no login, and no user record. There is no profile to build because there is nothing to attach one to. We can tell that a session happened and roughly where it came from; we cannot tell who you are, and no lawful enrichment available to us would change that.
What the desktop application sends
Only if you allow it. The choice is offered on first run, with equal prominence given to declining, and it can be changed at any time in Preferences. Declining costs no functionality. In the EU, EEA and UK nothing is sent unless you opt in.
- An anonymous install ID — random, regenerated if you reinstall, never derived from your hardware
- App version, release channel, and operating system major version
- Which comparison engine ran, and whether it found any changes
- How long a comparison took, and roughly how large the input was, in broad bands
- Crash type — the exception name only, never the message
Update checks
The desktop application asks recension.pages.dev once a day whether a newer version exists. This is separate from the choice above and is not covered by it: declining to send usage data is declining to be measured, not declining security fixes.
The request carries the version you are running, your operating system and your processor architecture — the three things needed to answer which build applies to you. It carries no identifier, nothing about your documents, and nothing about how you use the app. Like any web request it reveals your IP address to the server, which is handled as described below.
Nothing is installed without you agreeing to it. When an update is found the app says so and waits; it never replaces itself in the background.
An administrator can turn this off for a managed device by putting updates = off in the policy file. When they have, the app says so and names the file, rather than quietly going stale.
What is never sent
This list is enforced by the shape of the data, not by care. The event type has no free-form text field, so there is nowhere to put a filename even by mistake, and the database refuses any payload carrying one.
- The contents of any file you compare
- File names, folder names, or paths
- Any text from your documents, or any part of a comparison result
- Your IP address, from the desktop app — it never sends one, and your location comes from the network edge without it. (Visiting the website is different: a web request necessarily reveals an address, which is held for 72 hours and then deleted. See the privacy page.)
- Your username, computer name, or hostname
- iManage credentials, tokens, or document IDs
- AI provider keys
- Share links
IP addresses
The application never sends your IP address. For web traffic, our server does not read it either: the network edge resolves a country before the request reaches us, so the geography arrives without the address it came from.
Where a raw address is briefly recorded, it is deleted within 72 hours by a database rule, leaving only a masked prefix — a /24 covers 256 addresses, and the masking is not reversible. After that there is nothing left to identify.
Where it goes
To recension.pages.dev, which is the same address the application already uses. There is no separate analytics domain and no third-party analytics service — no Google Analytics, no Segment, no embedded SDK of any kind. Nothing on these pages contacts a third party.
Your rights
With no accounts, you can be identified only by a session identifier or by an IP address inside the 72-hour window. Erasure is available for that window and we will honour it. After masking, the data is no longer personal and there is nothing left to erase.
That is data minimisation working as intended rather than a way of avoiding the question, and saying so plainly seems better than implying a capability we do not have.