Privacy Policy

OBSCURA OS is built so your data never has to leave your browser: in the free Workspace, in every single tool, and in every paid application (Keep, the Sovereign Suite, the Engineering Suite, the Photo Editor, PDF Studio, Case, Umbra, Books, Roots, Research, Practice, Write, Authorship, Sound, Vector, Erase and the Converter). This page explains exactly what that means, and what limited data does get collected.

Last updated: October 12, 2026

The short version

OBSCURA OS's tools, invoices, contracts, leases, listings, client records, the expense and time trackers, the Workspace Suite (Docs, Sheets, Slides, Forms, Drive, Calendar, Notes), and everything else across every product line, run entirely in your browser using local storage. We do not have a server database of your clients, invoices, leases, listings, or business records, and we cannot see the data you enter into any of these tools. Nothing you type into an invoice, contract, lease, or any other tool is transmitted to us or stored on our servers.

Running in your browser is not the whole security story. See the threat model for what each tool protects against, and what it does not.

What we do collect

Like almost every website, OBSCURA OS uses a small number of third-party services that collect limited technical data:

• Hosting and analytics (Cloudflare): our host, Cloudflare, automatically logs standard technical information for every visit, such as IP address, browser type, and pages requested, for security and aggregate traffic reporting. This is typical web server behaviour and is not tied to your name or account, because there are no accounts. Cloudflare Web Analytics is switched on. It is a setting in Cloudflare’s dashboard rather than anything in this site’s code, so Cloudflare adds a small script from static.cloudflareinsights.com to each page as it is served. It reports that the page was viewed, and reports the page, never anything you type, open or produce, because none of that is ever in a request to begin with. It sets no cookie, writes nothing to your device’s storage, and keeps no identifier that would let it recognise you on another page or another day; your address is used to work out a country and is not kept. That is why this site has never shown you a cookie banner. Nothing in the site’s own code loads it, and you do not have to take that sentence on trust: open your browser’s network panel and reload, or press the Sent from this page line at the foot of any page on this site (in an application, which has no foot, the Private · verify badge), which lists everything that page has contacted since you opened it. Cloudflare’s host is the only one besides this site that will ever appear there, and the build checks that against the live site on every deployment, so this paragraph cannot quietly stop being true.
• The site’s own page count: one page in four, chosen at random by your browser, sends one small request back to this site, to /api/hit, holding three things and nothing more:
  • The page’s address, such as /seal, without anything after a ? or a #.
  • What happened, as one word from a fixed list: the page was viewed; a page that does not exist was asked for (and then the address is the one that was asked for, counted only if it looks like one of this site’s addresses); a file was opened in a tool; the save paywall was shown; a plan’s checkout button was pressed, and which plan; a checkout came back to the Pro page paid, with nothing about who paid or what; a Pro key was unlocked; a file was passed to another tool; something was shared; somebody joined a waitlist; the site was installed as an app; an invitation link was followed; or you came to this page from one of the site’s guides, and which guide. To know that last one, the guide’s address is kept in this tab’s session storage until the next page opens, and goes nowhere else.
  • Where the visit came from, as one word: the name of a search engine (Google, Bing, DuckDuckGo, Ecosia, Brave, Yahoo, Yandex, Startpage, Qwant or Kagi), Reddit, Hacker News, GitHub, Mastodon, LinkedIn or X; “other” for any other website; “internal” for another page of this one; or “none”. Never the address you came from.
  Two more kinds of request use the same three fields. When you arrive from a search engine, one says your browser’s language, as English, German, French, Spanish, Italian, Portuguese, Dutch, Polish, Swedish, Russian, Japanese, Chinese or “other”. And on one of those counted pages in five, so one page view in twenty, up to three more as you leave say how quickly the page drew, how quickly it answered a click and how much it jumped about while loading, each only as good, needs improvement or poor, with the kind of page it was (a tool, a guide, an application or a hub page), never the measurement itself.
  
  The steps towards paying (the save paywall shown, a plan’s button pressed, a checkout come back paid, a key unlocked, a waitlist joined, the site installed, an invitation followed, something shared) are sent from every page they happen on, not one in four. The server adds to a count for that day and those words (four for a page counted one in four, one for the rest), in a database in our own Cloudflare account, and keeps nothing else. Not your IP address. Not your browser or its user agent, which is read only to leave known robots out of the count and is never stored. No cookie is sent with it and none is set. No identifier of any kind, so nothing can tell one visit from another or connect two of them. None of it is ever about a file, because what you open in a tool is never in any request to begin with. Nothing is sent at all if your browser has Global Privacy Control or Do Not Track switched on, while the site is sealed (Settings, Sealed), or from the owner’s own pages. The Sent from this page line at the foot of each page counts these requests and lists them under their own name, and your browser’s network panel shows each payload in full. The counts are read by the site’s owner, behind a key, at /stats. If the owner ever chooses to show them to everyone there, what anyone would see is the site’s daily totals and the thirty pages most often reached from a search engine.
• Program code, served from here: about fifteen of the heavier tools need a library to do their job, a PDF engine, a spreadsheet reader, a face detection model. They used to fetch it from cdnjs.cloudflare.com or cdn.jsdelivr.net, which told those two hosts your IP address and which tool page you were on. They are now served from obscuraos.com instead, so your browser does not contact either host. The two tools that download a model, SCRIBE for transcription and VEIL for face detection, get it through obscuraos.com as well. In every case the download travels one way: your file is never part of any request, and once a tool has run once the library stays on your device and the tool works offline.
• Sovereign’s connectors (Pro, only when you use them): the Sovereign Suite can read your own GitHub, Microsoft 365, Google Workspace or Okta, read-only, when you press its button, with a token or a sign-in you give it. Those requests go from your browser straight to that provider (api.github.com, graph.microsoft.com and login.microsoftonline.com, admin.googleapis.com, or your Okta domain); nothing about them reaches us, and the token stays in your browser’s memory unless you choose to keep a GitHub token sealed with a passphrase on your device. That page alone is allowed to reach those providers: see /trust. What was read is kept in your browser, like the rest of the Suite.
• Timestamps, only when you ask: Authorship, PDF Studio and a paid application’s receipt can add an RFC 3161 timestamp. What is sent is a SHA-256 fingerprint, 32 bytes that cannot be turned back into anything, through this site’s /api/tsa to DigiCert’s or Sectigo’s public time-stamping authority, which signs the fingerprint and the time. The server passes the request on and keeps nothing. The receipt itself, like everything else you make, stays on your device unless you give it to somebody.
• No advertising: OBSCURA OS shows no ads and loads no advertising or ad-measurement scripts. Nothing on the site profiles you for anyone.
• The letter (optional): if you give your email for the occasional letter, on its page, the front door, the end of a guide or the card shown once after the site is installed, we store that email address, the date, and what you asked for, in our own Cloudflare account. Nothing else is stored with it: no IP address, no browser details. It is used only to send what you asked for, and you can take it off on the unsubscribe page or ask us to delete it at any time.
• Pro keys: if you buy Pro or a day with one tool, your key is kept in this browser's storage, and in a cookie named obscura_pro that is sent only to the addresses that serve Pro code (/pro-code/), so the server can check the key before it hands the code over. The key says which plan you have, whether it is paid by the month or the year, when a free trial ends, and until when; it carries no name and no email address. To make or renew a key, this site asks Stripe about your payment; a browser with a subscription’s key renews it once a day when it is online, which is how it learns that a payment needs you. When you buy, your key and a link that signs in any device are emailed to the address you paid with, through our email provider, Resend; signing in by email later sends your address to Stripe, to look up the payment, and to Resend, to send it again. We do not store your address: all we keep is a note that the email for that checkout has gone, holding Stripe’s reference for the checkout and the time, so it is sent once. If a payment does not go through, or your bank asks you to confirm it, the address on Stripe’s invoice is sent Stripe’s page for that invoice, and for three days we keep a note that it went, holding the invoice reference and the time. If you subscribe with a friend’s invitation, we also keep a note pairing your Stripe subscription with theirs, with no names or addresses, so that they can be credited once when you first pay.
• Seats on Team and Business: if your organisation’s admin gives you a seat, we keep your name and email address as they typed them, the dates you were added, joined and removed, and a record of those changes, in our own Cloudflare account, so the admin can manage the plan and show an auditor who had access. Where this site sends email, your invitation goes to that address through Resend. Nothing about what you open or do with the tools is kept, because none of it reaches us. For your organisation we are its processor; the data processing agreement sets out the terms, and how long each part is kept.
• Payments (Stripe): if you buy Pro or a day with one tool, payment is handled entirely by Stripe on Stripe's own secure checkout page. OBSCURA OS never sees, receives, or stores your card number or other payment details, that information is processed and retained by Stripe under Stripe's Privacy Policy. Stripe will have your email and payment method for billing purposes, and tells our server when a checkout has been paid, so your key can be made and emailed. The server that hands out Pro code checks your key, and asks Stripe whether that subscription is still paid; it never sees your card or anything you open.

Local storage

OBSCURA OS's tools use your browser's built-in local storage to remember things like your saved preferences, profile, documents, and unlock status, so you don't have to re-enter them every visit. This data stays strictly on your device, it is never uploaded to us, regardless of which tool or suite you're using. Clearing your browser's site data or switching browsers/devices will clear it, since there is nothing backed up elsewhere unless you export it yourself.

The site’s service worker keeps a note of the requests it handles (the address, the method, how it was answered and how many bytes a request carried, never the bytes), so that a paid application’s receipt can list them. The notes are in its memory only, the last two thousand, and go when the browser stops it; they are never written to the device or sent anywhere. Whether the site is sealed, and when it was sealed before, is kept in a cache of its own on this device.

Your rights & controls

Because there is no account and no server-side copy of your data, the rights privacy regulations like the GDPR and CCPA are designed to guarantee are already true by default here:

• Access: your data already lives only on your own device, in your browser. There is nothing held elsewhere for us to hand back to you.
• Portability: use the export/backup option in Settings, or the relevant app's own export/download action, to get your data out in a plain file at any time.
• Deletion: clear this site's data from your browser (or use any in-app "clear data" control) and it is gone, immediately and completely, because that browser storage is the only place it ever existed. There is no account to delete because none was ever created.
• No sale of personal information: we do not sell, rent, or share your business data with anyone, because we never receive it in the first place. The limited technical data described above is collected by our hosting and payment providers directly, under their own policies, apart from the page count, which is ours and is described in full above.

Cookies

OBSCURA OS sets no tracking cookies and no advertising cookies. The one cookie it sets is obscura_pro, and only once you have bought Pro or a day with one tool: it holds your key, and is sent only to the addresses that serve Pro code, never to any other page and never to anyone else. Your preferences (theme, colourway, and the like) are kept in your browser's local storage, which never leaves your device. Stripe sets its own cookies on its checkout page, described in Stripe's policy linked above.

Children's privacy

OBSCURA OS is a sovereign digital workstation intended for professionals, researchers, independent operators, and businesses, and is not directed at children. We do not knowingly collect information from anyone under 13.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new "last updated" date.

Contact

Questions about this policy can be sent to [email protected].