We also make a cloud product under this name. This is not it.  Use that one and you are uploading on purpose.

Privacy policy — Creasepoint

ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India. Last updated 2026-09-03. Published at creasepoint.com/privacy, which is generated from this file rather than written beside it — there is one copy of each sentence here, and that is deliberate. Versioned in public at github.com/arafathhashmi/creasepoint/blob/main/PRIVACY.md; its history is the changelog.

0. The uncomfortable things first

Three things are true that a privacy policy would normally bury, so they go at the top.

  1. We make a separate cloud product under the same brand. If you use that one, you are uploading your documents on purpose. This application is not involved in it, shares no code with it, and has no control that sends anything to it. We say this first rather than leave it for someone else to find.
  2. We cannot stop Windows reporting crashes to Microsoft, and a crash report can contain part of your document. We collect no telemetry of our own — there is no analytics, no usage counter, no phone-home. But Windows Error Reporting is part of the operating system, and publishing through the Microsoft Store shows us anonymous crash counts and stack traces. Neither is ours to switch off. And a crash report is not always just a stack trace: if the code reading your PDF crashes in a way Windows treats as memory corruption, Windows can take a dump of that process, and the process is at that moment holding your document. Your document's contents could travel in that dump. This is the one route by which anything from a document you opened can leave your machine, it is real, and §2 has the detail on what we do about it.
  3. One feature makes a network request, and only if you turn it on. See §3.

1. What this application collects

Nothing.

There is no account, no sign-in, no sync, no profile, no licence check, no update check, no usage analytics and no crash upload of our own. We do not know how many people use this application, which features they use, or that any particular installation exists.

There is no code in this application that makes a network request. The build asserts this — a test reads the compiled assemblies' reference tables and fails the build if networking types appear — and both the assertion and the source are public. The single exception is the separate helper program described in §3.

2. What happens to your documents

They stay on your machine.

Every document you open is parsed in a separate, confined process on your own computer, and the result is written to a file you choose. Nothing is uploaded to us, queued, cached remotely, or retained by us in any form. We never see your documents, their names, their contents or their number.

Test it rather than believe it. Turn on airplane mode. Every feature still works, with the one exception below.

The exception we cannot close, stated plainly. The reason your document is parsed in a separate process is that PDF parsers are where memory-safety bugs live, and a malformed file is the classic way to trigger one. When that kind of crash happens, Windows can write a dump of the crashing process and send it to Microsoft, and that process is holding the document it was reading. The crash-handling opt-outs an application can set do not survive this particular kind of failure — that is documented behaviour of the operating system, not a setting we forgot. What confinement buys is that the process in the dump is a minimal one that holds one document and nothing else: not your other open files, not the rest of the application. It does not buy immunity, and we are not going to describe it as though it does. This goes to Microsoft under Microsoft's policy; it never goes to us.

3. The one exception: timestamping a digital signature

When you add a digital signature to a document, you may optionally ask a public time authority to attest the hour it was signed. That is a genuine network request, and it is off unless you choose it.

When you do choose it:

  • A separate program, Creasepoint.Timestamp.exe, makes the request. It is the only code we wrote that opens a network connection, and it runs in its own short-lived process that exists only for the length of the request. The package also carries the .NET runtime and the Avalonia user interface framework, and those include networking libraries we never call — System.Net.Http.dll and around twenty siblings. If you unzip the package you will find them, so we would rather tell you than have you discover it. What we can say, and what the build checks, is that none of our own code refers to them.
  • It sends an RFC 3161 timestamp query, which contains a cryptographic hash of your signature. It does not send your document, any part of its content, or its name. A hash cannot be turned back into the thing it was computed from.
  • It sends no cookies, follows no redirects, and gives up after 20 seconds.
  • It goes to the time authority you choose. The application offers a short list of public ones and selects none of them for you: the box is empty until you pick or type an address. That was a deliberate change — it used to arrive pre-filled with DigiCert, which meant the sentence above would have been describing a choice we had made on your behalf.
  • Whichever authority you choose is a third party. It is not us, what it logs is its policy and not ours, and it will typically see your IP address and the time of the request, as any web server would. If you pick one of the two we list, see §5.
  • The request travels over plain HTTP, because that is what the public RFC 3161 services listen on — we checked, and DigiCert's does not answer on port 443 at all. It matters less than it looks: the authority's reply is signed, so nobody on the path can forge a timestamp. What an observer on your network can see is that you asked a timestamp authority for one, and roughly when. If that matters to you, leave the box unticked, or point it at an authority inside your own organisation.

If you never sign a document, or you sign without the timestamp option, this program never runs.

4. What we do not claim

We do not claim this application cannot reach the network. Windows does not let an ordinary desktop application permanently surrender network access, and a claim we cannot enforce is worth nothing. What we claim instead is checkable: our code contains no network request, the build proves it, and you can read both.

On Android the claim is stronger, because the platform makes it stronger: the application declares no android.permission.INTERNET, an application without it cannot open a socket at all, and its absence is a static property of the installed package you can verify yourself with aapt dump permissions.

5. Third parties

We use no analytics provider, no advertising network, no crash-reporting service, no content delivery network and no cloud storage in this application. We share nothing with anyone, because we have nothing to share.

The one third party the application can contact during normal use is a timestamp authority, and only if you turn the timestamp on and choose one. The two the application offers are:

  • DigiCert (timestamp.digicert.com) and Sectigo (timestamp.sectigo.com) — public RFC 3161 services that need no account. Whichever you pick receives a hash of your signature and sees your IP address and the time. It does not receive your document or its name. You can replace either with any RFC 3161 authority, including one your organisation runs; nothing is chosen for you.

Distribution channels have their own policies we do not control:

  • Microsoft Store — Microsoft handles the download and shows the publisher anonymous crash counts. See Microsoft's privacy statement.
  • GitHub — if you download a release directly, GitHub sees the request.

6. What Windows does that we do not control

Everything above is about what this application does. Windows does things of its own to any document open on the screen, and none of them is ours to switch off. Naming them is more useful than a claim that quietly assumes them away.

  • Windows Recall, on Copilot+ PCs, takes periodic screenshots of the screen and indexes them. It is off unless you turn it on, and it is a feature of the operating system rather than of any application. If it is on while you have a document open, the operating system has a picture of that document.
  • Clipboard history and Cloud Clipboard. Text you copy can be kept in Windows' clipboard history and, if you have that syncing turned on, sent to your Microsoft account.
  • Microsoft Defender sample submission, on by default, can upload a file it finds suspicious to Microsoft for analysis.
  • Windows Search indexes the contents of files in indexed locations, including anything you save.
  • OneDrive folder backup silently syncs Desktop and Documents on many machines, so a file you saved "locally" may be in the cloud because a setting elsewhere says so.

We are not going to describe any of these as our failure or as something an application can prevent, because neither is true. They are listed because someone comparing what this policy says against what their machine actually does deserves to find the list here first.

7. Children

This application has no accounts, no user-generated content and no communication features, and collects nothing from anyone of any age.

8. Your rights

Data-protection law gives you rights of access, correction, erasure and portability over personal data a company holds about you. We hold none, so there is nothing to access, correct, erase or port. This is not a refusal — there is genuinely no record of you.

If you believe otherwise, write to us and we will look.

9. Changes

Material changes are recorded in this file's public git history, and a change that weakened any statement above would need a superseding entry in docs/DECISIONS.md, which is also public and append-only. That is a deliberately awkward process, because the ability to quietly weaken a privacy policy is the thing this project most wants to deny itself.

10. Contact

ARHAS INDIA (OPC) PRIVATE LIMITED, Hyderabad, Telangana, India — privacy@arhas.in

If that address bounces, open an issue at github.com/arafathhashmi/creasepoint/issues and say so. Publishing an address that does not receive would be a small dishonesty of exactly the kind the rest of this document exists to avoid, and this project has done it once before (SECURITY.md, and DECISIONS.md #036).

Security issues have their own route: see SECURITY.md.