Privacy
Last updated: 29 October 2026
Your file never leaves your browser
This is not a promise about how we handle your file after receiving it. We never receive it.
ScrubDrop is a static website: HTML, CSS and JavaScript files served from a CDN, with no application server and no database behind them. When you drop a .docx, .xlsx or .pptx on the scrub page, the file is read by JavaScript running in your own browser tab, using the browser's File API. It is unpacked with fflate, rebuilt with JSZip, and checked again with fflate, xmldom, SheetJS and docx-redline-js, and a third time with the browser's own decompressor and fast-xml-parser, all running in your tab. The cleaned file you download is assembled in memory and handed to your browser as a local blob: download. At no point is there any code on the page that sends the file, its contents, the list of what was found in it, or anything derived from them anywhere.
This page is about what leaves your browser. What ScrubDrop can and cannot find in a file is listed under What this tool cannot do on the scrub page.
The paid version does not change that. Buying ScrubDrop Pro adds a payment and a licence key; the code that talks to Paddle and the licence service sends a transaction ID or a licence key and nothing from a document — the detail is under Paying for the paid version below.
What the browser enforces. Every page is served with a Content Security Policy. Its connect-src directive, which governs the page's fetch, XHR and beacon requests, lists Google Analytics' collection addresses, *.paddle.com, license.tekiba.app and its test copy, and not this site's own address: a fetch or beacon to this site from the page is refused by the browser. form-action 'none' stops any form being submitted anywhere. That closes the usual ways a page sends data back to its own site; it is not a sandbox around the page — other requests, such as loading the page's own scripts and images, are allowed, and the listed services can be reached — so the rest rests on what the code does, which you can watch for yourself as below. You can read the policy in the response headers of any page.
How to check this yourself
- Open the scrub page.
- Open your browser's developer tools and go to the Network tab.
- Check and clean a file.
- No request appears carrying your file, its text, or the words you typed. The only requests are the page itself and its own files from this site. Nothing to do with payment is loaded unless you press a buy button. (If this browser holds a ScrubDrop Pro key or a purchase still being confirmed, opening a page can also make the licence request described under Paying for the paid version — a key or a transaction ID, never anything from a file.)
What the page loads
Everything the scrub page itself needs is served from this site, including the libraries that read the file — so reading and rewriting it involves no other party at all. There are no fonts from another domain, no trackers, and no advertising.
| What | From | Why |
|---|---|---|
| Page, styles, the code that reads, cleans and re-checks the file | this site | To show the page and do the work. The reading and cleaning run in a background worker in your tab (/assets/scrub-worker.js), which is under the same Content Security Policy as the page. |
| The three sample files | this site, inside the page's own code | Made-up documents to try the tool on. They are part of the script, so trying one sends nothing and fetches nothing. |
| Google Analytics | googletagmanager.com, google-analytics.com | Not switched on. The page is allowed to load it, and loads nothing: there is no measurement id in /assets/config.js. Even once it is, it is loaded only on scrubdrop.tekiba.app itself: not on a preview copy, a local copy or a test run. The events it would send are listed below. |
| Paddle's checkout | paddle.com | Only after you press a buy button. Nothing from Paddle is loaded otherwise. Purchasing is not switched on yet. |
| The licence service | license.tekiba.app | Only if you have bought: to fetch your key after a purchase, and to check about once a month that it has not been refunded. |
| The licence service's test copy | tekiba-license-sandbox.metluno.workers.dev | The same two requests, against a sandbox copy used to rehearse a purchase without a real payment. /assets/config.js names it on every address other than scrubdrop.tekiba.app and tekiba-scrubdrop.pages.dev — a preview copy, a local copy or a test run — and names license.tekiba.app on those two. |
A script this site does not use
Cloudflare, which serves this site, adds its own analytics beacon (static.cloudflareinsights.com) to pages it hosts. This site's Content Security Policy does not allow it, so your browser refuses to load it and it collects nothing. If you look at the developer console you will see it being blocked — that is the policy doing its job, and it is the same policy that stops this page sending your document anywhere.
Google Analytics, when it is switched on
These are the only events this site's own code would send (/assets/analytics.js, which drops any event or parameter not listed here). None carries a file, its name, its text, an author, what was found in it, or a price.
| Event | When | What it carries |
|---|---|---|
sample_used | One of the made-up samples is opened | format: docx, xlsx or pptx (which sample). |
tool_result | The list of what a file holds is on screen | tool: scrub or ja/scrub (which page). demo: only for a made-up sample — docx, xlsx or pptx. |
export | A cleaned file, a ZIP or a report is downloaded | product: scrubdrop. format: docx, xlsx, pptx, zip, report_pdf or report_json. demo as above. |
paywall_view | A Pro limit is shown: several files dropped at once, or a kind only Pro removes is on the list | product: scrubdrop |
buy_click | The buy button is pressed | product: scrubdrop |
unlock | A ScrubDrop Pro key is accepted | source: claim (just bought) or manual (pasted in). Never the key. |
guide_to_tool | A link from a guide to the scrub page is followed | from: the guide's own address, such as guide/word-rsid-fingerprint. to: scrub or ja/scrub. |
pack_interest | "Request full pack" is pressed on the datasets page (the button opens an email in your own email program; nothing is collected) | pack: office-metadata. page: datasets or ja/datasets. |
Google's tag also adds, on its own, a page_view when a page opens and the details it attaches to every event on any site (the page's address and title, the previous page, the browser's type, language and screen size).
After a purchase, Paddle sends you back to a page whose address carries your transaction ID, and that ID can be exchanged for your licence key. Google Analytics would ordinarily put the whole page address into its first event. So analytics refuses to start at all while a transaction ID is in the address bar, the ID is removed from the address before anything else runs, and that page is served with Referrer-Policy: no-referrer so the ID cannot travel to the next page either.
What that does not do, and we would rather say so than imply otherwise: the very first request for that page is made by your browser before any of our code runs, so the address — transaction ID and all — reaches the service that hosts this site in the ordinary way any web address does. We do not run a server and do not keep request logs of our own, but we cannot make a claim about our host's.
Paying for the paid version
Payment is handled by Paddle, who are the merchant of record. Your card details go to Paddle and never to this site — ScrubDrop has no server to receive them and no form that could send them. Paddle is the data controller for what you give them: name, email address, billing country, card details and tax status. What they do with it is covered by Paddle's privacy policy. We can see that a purchase happened and its transaction ID; we never see a card number.
There is no account. You are not asked for an email address by us, there is no password, and nothing is stored about you on any server of ours — because we do not run one. What a purchase produces is a signed licence key, saved in this browser's local storage, and that is the whole of it.
What the licence service is sent, and when
| When | What is sent | To |
|---|---|---|
| Straight after a purchase, and again every couple of seconds until the key arrives or a minute passes | Your Paddle transaction ID (txn_…) | The licence service's /claim |
| If you paste a transaction ID in to get a lost key back | The same | The same |
| When you open or reload a page of this site while a purchase's transaction ID is still held in this tab's session storage | The same, once per page load | The same, to find out whether that purchase has been refunded |
| At most once a month, and only if you have a key | Your licence key | The licence service's /verify, to find out whether it has been refunded |
| Once more, straight away, if the licence service tells us the purchase this tab is looking at was refunded | Your licence key | The same, so that a refunded key stops working now rather than in up to thirty days |
That is every request the paid version can make. Nothing in the code that talks to the licence service can reach the scrub page, and nothing in the scrub page can reach your key: what passes between them is a single yes-or-no, in one direction. Checking a key does not use the network at all — the key carries its own signature and the page checks it offline.
The licence service keeps, per purchase, the transaction ID, the issued key and the date — no name, no email address, no card details, and nothing about the files you checked. It is a Cloudflare Worker with a key-value store and no other database.
Cookies and local storage
ScrubDrop sets no cookies. It stores these things in this browser's local storage, all readable and deletable by you (clearing this site's data in your browser removes all of them), and none sent anywhere except as the table above says:
| What | When | What is in it |
|---|---|---|
| Your licence key | If you buy, or paste a key in | The key. “Remove the key from this browser” on the key page deletes it. |
| When the key was last checked, and when a check was last tried | With the above | Two kinds of timestamp — one per key, written as a check is sent, and one for the page's last attempt — so the key is not sent more often than once a month. They stay after the key is removed. |
| Keys found to be refunded | Only if a check finds a key refunded | The ID part of each refunded key (up to 50), so that pasting a refunded key again does not unlock the paid features. Not a working key. It stays after the key is removed. |
| Which key should be saved | If you buy, paste a key in, or remove the key | A count that goes up each time the key is removed, and the key accepted since then (a second copy of the key above). Tabs of this site share it, so that a tab still finishing an earlier purchase puts back the right key rather than an older one. Removing the key empties the copy; the count stays. |
| Saved settings, and the last settings used | Only if you save a set, or clean a file | For each set: its name, the day it was saved, which kinds are ticked, and whether tracked changes are accepted or rejected. The last settings used are the same ticks without a name. Never a file, a file name, anything found in a file, or the names of reviewers. Delete them on the scrub page, or with this site’s data. |
While a purchase is being confirmed, the transaction ID is also held in session storage, so that closing the tab by accident does not lose it. Session storage is gone when the tab closes. “Remove the key from this browser” removes that too.
Your file and what was found in it are never stored. They exist in the tab while it is open, and nowhere else. The audit report of the paid version is written in the tab too, and saved only if you download it.
Who runs this
ScrubDrop is operated by Tekiba, an independent software project. We do not sell data, because we do not have any to sell. Questions about this page can be sent to hello@tekiba.app.
Changes
If this page changes in a way that affects what leaves your browser, the date at the top changes and the change is described here.
29 October 2026. /assets/config.js now has two sets of values, as RedactDrop's does: on scrubdrop.tekiba.app and tekiba-scrubdrop.pages.dev it names the licence service, license.tekiba.app; everywhere else, its test copy. Either is asked only by someone who has bought, as before. Purchasing and Google Analytics are still not switched on.
8 October 2026. One more event is listed for when Google Analytics is switched on: pack_interest, sent when "Request full pack" is pressed on the new datasets page, carrying only which pack and which page. The button opens an email in your own email program; the page collects nothing. Analytics is still not switched on.
7 October 2026 (later). One more event is listed for when Google Analytics is switched on: sample_used, sent when one of the made-up samples is opened, carrying only which sample it was. It is still not switched on: nothing is sent.
7 October 2026. Saved settings: the scrub page can keep named sets of which kinds are ticked, and the last ones used, in local storage (the table above). They stay in the browser. Nothing new leaves it.
3 October 2026. Google Analytics, once switched on, is loaded only on scrubdrop.tekiba.app itself, so a preview copy, a local copy or an automated test sends nothing. It is still not switched on.
2 October 2026 (later). The events Google Analytics would be sent once it is switched on are listed, with every value each can carry. It is still not switched on: nothing is sent.
2 October 2026. The Content Security Policy is described for what it covers (the page's fetch, XHR and beacon requests, and forms) rather than as a guard around everything; the licence requests now include the check of a pending purchase when a page is loaded; local storage now lists both kinds of check timestamp and the IDs of refunded keys, and says where the key can be removed. These describe what the code already did. Nothing new leaves the browser.
30 September 2026. First version.