# PrivateRedact - Client-Side Document Redactor

A deployable static website that lets visitors:

- Drag and drop a PDF, PNG, JPG, or WebP file.
- Draw black redaction boxes over sensitive information.
- Work page-by-page on multi-page PDFs.
- Preview the flattened result.
- Export an image as a new PNG.
- Export a PDF as a completely new raster-only PDF.

## Why the exported PDF cannot be un-redacted

The application does **not** place editable rectangles over the original PDF. During export it:

1. Renders every source PDF page to a canvas.
2. Draws opaque black pixels over the selected areas.
3. Converts the complete page to a JPEG image.
4. Creates a new PDF and embeds only those flattened page images.

The original selectable text, form fields, annotations, embedded files, layers, JavaScript, document structure, and hidden content are not copied to the exported PDF.

This is substantially safer than adding black annotations, but the user must still inspect the final exported file before sharing it.

## Files

- `index.html` - interface and page structure.
- `styles.css` - responsive light/dark design.
- `app.js` - PDF/image loading, redaction editor, flattening, and export.
- `privacy.html` - privacy disclosure template.
- `.htaccess` - optional Apache configuration.

## Run locally

Browsers restrict ES modules when opened with `file://`, so use a local web server.

### Python

```bash
python -m http.server 8080
```

Then open `http://localhost:8080`.

### PHP

```bash
php -S localhost:8080
```

## Deploy

Upload all files to a static web host or Apache/Nginx public directory. HTTPS is strongly recommended.

## Maximum-privacy deployment

The default version imports these libraries from CDNs:

- Mozilla PDF.js
- PDF-Lib

For sensitive deployments, self-host them:

1. Download `pdf.min.mjs` and `pdf.worker.min.mjs` from the same PDF.js release.
2. Download `pdf-lib.min.js`.
3. Put them in an `assets/vendor/` directory.
4. Replace the CDN URLs in `index.html` and `app.js` with local paths.
5. Remove or leave disabled the Google Analytics placeholder.
6. Use a strict Content Security Policy that allows only your own domain.

## Practical security notes

- The website intentionally rasterises PDFs, so exported PDFs lose searchable/selectable text.
- The source file remains in browser memory while the tab is open.
- Very large PDFs can consume substantial memory. A desktop browser is recommended.
- Password-protected PDFs are not supported in this version.
- The editor does not automatically detect private information.
- Users should cover the full text area, including anti-aliased edges and shadows.
- Users should open and inspect every exported page before disclosure.
- This tool is not a substitute for a formal document-release or legal-review process.

## Custom branding

Change the `PrivateRedact` name in `index.html`, `privacy.html`, and `app.js`. Main design variables are at the beginning of `styles.css`.

## Google Analytics

Search `index.html` for `G-XXXXXXXXXX`. Analytics is disabled because the configuration call is commented out. Before enabling it, add a compliant consent mechanism and update the privacy disclosure for the jurisdictions you serve.