The uncomfortable
things first.

The privacy policy in full

ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India. Last updated 2026-09-25. Published at creasepoint.com/privacy, which is generated from this file rather than written beside it — there is one copy of each sentence here, and that is deliberate. This file also ships inside the application package, so the copy you were given is the copy that was current when your version was built, and you can read it without asking us.

Where those two can differ, said plainly. The website always carries the newest text; the package carries the text as at its release. §1's description of update checking was corrected on 2026-09-09, after 1.0.0 had shipped — so a 1.0.0 installation contains the older, less accurate paragraph until the next release replaces it. The correction is on this page now because waiting for a release to tell you would be the wrong way round. The same is true of §1's list of what the package's import tables show, corrected on 2026-09-24: 1.0.1 and earlier carry a shorter list that names one of the three files you will find.

0. The uncomfortable things first

Three things are true that a privacy policy would normally bury, so they go at the top.

1. A separate cloud product is planned under the same brand, and does not exist yet. If you ever use that one, you are uploading your documents on purpose. This application is not involved in it, shares no code with it, and has no control that sends anything to it. We say this first rather than leave it for someone else to find.
2. We cannot stop Windows reporting crashes to Microsoft, and a crash report can contain part of your document. We collect no telemetry of our own — there is no analytics, no usage counter, no phone-home. But Windows Error Reporting is part of the operating system, and publishing through the Microsoft Store shows us anonymous crash counts and stack traces. Neither is ours to switch off. And a crash report is not always just a stack trace: if the code reading your PDF crashes in a way Windows treats as memory corruption, Windows can take a dump of that process, and the process is at that moment holding your document. Your document's contents could travel in that dump. This is the one route by which anything from a document you opened can leave your machine without you sending it, it is real, and §2 has the detail on what we do about it. Printing is you sending it: the pages go through Windows' print queue to the printer you choose, and if that printer is on your network or in the cloud, Windows sends them there.
3. One feature makes a network request, and only if you turn it on. See §3.

1. What this application collects

Nothing.

There is no account, no sign-in, no sync, no profile, no licence check, no usage analytics and no crash upload of our own. We do not know how many people use this application, which features they use, or that any particular installation exists.

The application itself never checks for an update. Windows does, and how often depends on how you installed it. There are three cases and they are genuinely different.

From the Microsoft Store. The Store keeps the application up to date on Microsoft's own schedule, the way it does for everything you install from it. That is between you and Microsoft. It tells us nothing about you; we see the anonymous counts any publisher sees, and no request reaches us.

From our update manifest — a direct-download channel that is planned and is not serving yet. When it exists, Windows will check our server for a newer version in two ways, not one: when the application starts, at most once in any twenty-four hours, and every eight hours in the background, whether or not the application is running. Both are Windows' own installer asking for one XML file; neither is code in this application. What reaches us is what any web server sees when something requests a file — an address, a time, and which file was asked for.

From the .msix package directly. Nothing checks anything, ever.

We would rather describe it than let you find it — and this paragraph is the second attempt. Until 2026-09-09 it said "once a day" and described only the launch check, omitting the background one entirely. That understated our own behaviour by three times over on a page whose whole job is to describe it, and it is corrected here rather than quietly.

Apart from the optional timestamp on a digital signature, which §3 describes, there is no code in this application that makes a network request. The build asserts this: a test reads the compiled assemblies' reference tables, and a second reads the native import tables, and either fails the build if networking appears where it is not declared.

You do not have to take our word for that test. An .msix is a zip file. Unzip the one you installed, run dumpbin /imports over what is inside, and read the answer off the binaries you were actually given rather than off a promise about a build you did not watch. Three files will show Windows networking imports, and this is what they are. Measured on 2026-09-24 in the x64 and the arm64 package alike; all three are the same files 1.0.1 shipped.

• tesseract.dll, the OCR engine, imports ten functions from WS2_32.dll: getaddrinfo and freeaddrinfo by name, and eight by number - WSAStartup, WSACleanup, socket, connect, send, recv, select and closesocket. dumpbin prints those eight as ordinals; dumpbin /exports on Windows' own ws2_32.dll names them. Going by the strings beside them and by how the engine is built, they belong to ScrollView, Tesseract's own debugging viewer, which is compiled in and which no OCR feature switches on: the only Tesseract variable this application sets by name is debug_file, which sends its debug output nowhere, and nothing it sets switches the viewer on.
• msquic.dll is the .NET runtime's QUIC library, which is how .NET speaks HTTP/3. It imports a full set of socket, name-resolution and network-interface functions. Nothing in this application asks for HTTP/3. The timestamp helper in §3 is the only part of it that makes a request at all, and the helper from the 1.0.2 package, caught part-way through a request, had not loaded this file.
• createdump.exe is the .NET runtime's crash-dump helper. It imports WSAStartup, gethostname and WSAGetLastError, and this application does not use it.

None of those imports is reached by anything this application does, and an import is not a call. Reading the package is still how we find what we had wrong. third_party/README.md once said the OCR engine imported no networking at all, and that document was corrected rather than the sentence softened. This list is the second correction: until 2026-09-24 this policy named one of the three files and one of tesseract.dll's ten imports, and put that import down to a dependency of the OCR engine; the evidence above says it is Tesseract's own code. Anyone who took up the invitation would have found more than we said, which is the one thing this paragraph exists to prevent.

2. What happens to your documents

They stay on your machine.

Every document you open is parsed in a separate, confined process on your own computer. Nothing is uploaded to us, queued, cached remotely, or retained by us in any form. We never see your documents, their names, their contents or their number.

Nothing is written until you say so. Editing happens in memory: rotate a page, fill a form, add a signature, and the file on disk has not moved. When you save, you choose whether that replaces the document you opened or writes a copy, and the application says which it is about to do. There is no autosave, because an autosave would write to a file you had not chosen yet.

Test it rather than believe it. Turn on airplane mode. Every feature still works, with the one exception below.

The exception we cannot close, stated plainly. The reason your document is parsed in a separate process is that PDF parsers are where memory-safety bugs live, and a malformed file is the classic way to trigger one. When that kind of crash happens, Windows can write a dump of the crashing process and send it to Microsoft, and that process is holding the document it was reading. The crash-handling opt-outs an application can set do not survive this particular kind of failure — that is documented behaviour of the operating system, not a setting we forgot. What confinement buys is that the process in the dump is a minimal one that holds one document and nothing else: not your other open files, not the rest of the application. It does not buy immunity, and we are not going to describe it as though it does. This goes to Microsoft under Microsoft's policy; it never goes to us.

3. The one exception: timestamping a digital signature

When you add a digital signature to a document, you may optionally ask a public time authority to attest the hour it was signed. That is a genuine network request, and it is off unless you choose it.

When you do choose it:

• A separate program, Creasepoint.Timestamp.exe, makes the request. It is the only code we wrote that opens a network connection, and it runs in its own short-lived process that exists only for the length of the request. The package also carries the .NET runtime and the Avalonia user interface framework, and those include networking libraries we never call — System.Net.Http.dll and eighteen other System.Net assemblies (counted in the 1.0.2 package). If you unzip the package you will find them, so we would rather tell you than have you discover it. They are .NET code, so dumpbin /imports lists nothing networking against them; the three native files it does list are in §1. What we can say, and what the build checks, is that none of our own code refers to them except this helper, which uses System.Net.Http.dll to make its one request.
• It sends an RFC 3161 timestamp query, which contains a cryptographic hash of your signature. It does not send your document, any part of its content, or its name. A hash cannot be turned back into the thing it was computed from.
• It sends no cookies, follows no redirects, and gives up after 20 seconds.
• It goes to the time authority you choose. The application offers a short list of public ones and selects none of them for you: the box is empty until you pick or type an address. That was a deliberate change — it used to arrive pre-filled with DigiCert, which meant the sentence above would have been describing a choice we had made on your behalf.
• Whichever authority you choose is a third party. It is not us, what it logs is its policy and not ours, and it will typically see your IP address and the time of the request, as any web server would. If you pick one of the two we list, see §5.
• The request travels over plain HTTP, because that is what the public RFC 3161 services listen on — we checked, and DigiCert's does not answer on port 443 at all. It matters less than it looks: the authority's reply is signed, so nobody on the path can forge a timestamp. What an observer on your network can see is that you asked a timestamp authority for one, and roughly when. If that matters to you, leave the box unticked, or point it at an authority inside your own organisation.

If you never sign a document, or you sign without the timestamp option, this program never runs.

4. What we do not claim

We do not claim this application cannot reach the network. Windows does not let an ordinary desktop application permanently surrender network access, and a claim we cannot enforce is worth nothing. What we claim instead is narrower and still worth something: apart from the optional timestamp in §3, there is no code in this application that makes a network request, and the build asserts it. The source is not published, so that assertion is our word rather than something you can run. What you can do without us is the airplane-mode test in §2, and reading the import tables in the package you were given - where you will find the three files §1 lists, tesseract.dll, msquic.dll and createdump.exe, importing Windows networking functions that nothing in this application reaches. An import is not a call. Better you read that here than find it yourself.

The Android application has its own policy, and this one is about the Windows product. An earlier version of this paragraph described Android privacy properties in the present tense when there was no Android application; it then said that when one shipped it would get its own policy, written from what it actually does. That policy is now at creasepoint.com/privacy/android. The two products do not have the same privacy properties - the Android Play build holds a network permission, shows advertising, sells a subscription and has one feature that sends a document's text to a model - so nothing is inherited in either direction. Carrying a sentence from one onto the other is the easiest way for either policy to become false, and it has happened here before.

5. Third parties

We use no analytics provider, no advertising network, no crash-reporting service, no content delivery network and no cloud storage in this application. We share nothing with anyone, because we have nothing to share.

The one third party the application can contact during normal use is a timestamp authority, and only if you turn the timestamp on and choose one. The two the application offers are:

• DigiCert (timestamp.digicert.com) and Sectigo (timestamp.sectigo.com) — public RFC 3161 services that need no account. Whichever you pick receives a hash of your signature and sees your IP address and the time. It does not receive your document or its name. You can replace either with any RFC 3161 authority, including one your organisation runs; nothing is chosen for you.

Distribution channels have their own policies we do not control:

• Microsoft Store — Microsoft handles the download and shows the publisher anonymous crash counts. See Microsoft's privacy statement.

6. What Windows does that we do not control

Everything above is about what this application does. Windows does things of its own to any document open on the screen, and none of them is ours to switch off. Naming them is more useful than a claim that quietly assumes them away.

• Windows Recall, on Copilot+ PCs, takes periodic screenshots of the screen and indexes them. It is off unless you turn it on, and it is a feature of the operating system rather than of any application. If it is on while you have a document open, the operating system has a picture of that document.
• Clipboard history and Cloud Clipboard. Text you copy can be kept in Windows' clipboard history and, if you have that syncing turned on, sent to your Microsoft account.
• Microsoft Defender sample submission, on by default, can upload a file it finds suspicious to Microsoft for analysis.
• Windows Search indexes the contents of files in indexed locations, including anything you save.
• OneDrive folder backup silently syncs Desktop and Documents on many machines, so a file you saved "locally" may be in the cloud because a setting elsewhere says so.

We are not going to describe any of these as our failure or as something an application can prevent, because neither is true. They are listed because someone comparing what this policy says against what their machine actually does deserves to find the list here first.

7. Children

This application has no accounts, no user-generated content and no communication features, and collects nothing from anyone of any age.

8. Your rights

Data-protection law gives you rights of access, correction, erasure and portability over personal data a company holds about you. We hold none, so there is nothing to access, correct, erase or port. This is not a refusal — there is genuinely no record of you.

If you believe otherwise, write to us and we will look.

9. Changes

A change that weakened any statement above needs a superseding entry in the project's decision log, which is append-only: entries are superseded, never edited, so a claim that was quietly walked back leaves both versions behind. That is a deliberately awkward process, because the ability to quietly weaken a privacy policy is the thing this project most wants to deny itself.

And you can check it without us. This file ships inside the application package. Keep the .msix you installed, and when a new version arrives, unzip both and compare this document. A weakening is then a diff you hold, not a promise we make about our own record-keeping.

10. Contact

ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India — [email protected]

If that address bounces, write to the registered office above — ARHAS INDIA (OPC) PRIVATE LIMITED is a registered Indian company, CIN U62013TS2026OPC220112, and its address is a matter of public record with the Ministry of Corporate Affairs whatever happens to a mailbox.

Publishing an address that does not receive would be a small dishonesty of exactly the kind the rest of this document exists to avoid, and this project has done it once before: an address was published here before the mailbox behind it existed. That is why the fallback here is a company registration rather than a second address that could go the same way.

Security issues have their own route: see the security policy.