Privacy Policy

Moksh PDF Editor

Privacy for Moksh PDF Editor · last updated: 12 October 2026

This part explains what personal data MokshX Private Limited ("MokshX", "we", "us") processes in connection with Moksh PDF Editor (the "App"), its pages under mokshx.net/pdf-editor and its purchases, in line with the Information Technology Act, 2000 and the rules under it, and with the Digital Personal Data Protection Act, 2023 ("DPDP Act") as its provisions come into force.

The most important thing: the App works on your PC. Your documents, photos and scans — and everything you type, sign or extract from them — stay on your computer. They are never uploaded to MokshX. There is no account and no telemetry.

1. What the App never collects

• Your documents and images, their contents, file names and folders.
• Text read by OCR, data extracted from bank statements or invoices, and anything you redact.
• Your autofill profile (name, address, PAN and similar), which stays on your PC.
• Your DSC PIN, password or private key.
• Usage statistics, analytics or crash reports: the App sends no telemetry and no crash reports, needs no account, and its editor window is blocked from the internet.

When you convert a Word, Excel or PowerPoint file, the App opens it with the Microsoft Office installed on your own PC. The App sends nothing for this; Office itself works under Microsoft's settings and privacy statement.

2. When the App uses the internet

The App contacts the internet only in the cases below.

• Update check — at most once a day (the first time about 10 seconds after the App starts), and whenever you click Check now, the App fetches a small file from dl.mokshx.net to see whether a newer version exists. The check sends a random identifier that the App's update component creates once and stores on your PC. It is not made from your hardware, machine ID, request code or licence, it is not linked to you, and we do not use it to identify you. You can switch automatic checks off in Settings → Updates. An update is downloaded from dl.mokshx.net only when you click Download, and installed only when you click Restart to install and only if it is digitally signed (Authenticode) by MokshX Private Limited.
• Revocation list — about once a day (the first time shortly after the App starts), the App downloads MokshX's signed list of revoked licence IDs from dl.mokshx.net; if a download fails, it tries again an hour later until it succeeds. The list contains only licence IDs (with its date and signature), and the App checks your licence, if you have one, against it on your PC. This also happens in the free version and cannot be switched off. Nothing about you or your licence is sent.
• AI models and OCR language packs — only the ones you choose to install, downloaded once from dl.mokshx.net. For two files only — the small U²-Net-p background-removal model (u2netp.onnx) and the YuNet face-detection model (face_detection_yunet_2023mar.onnx) — if the download from our server fails, the App downloads the same file from a public copy on GitHub (the rembg project's release on github.com, and the OpenCV model collection on media.githubusercontent.com), which then receives the request under GitHub's own privacy statement. Every file is checked against its SHA-256 fingerprint before it is used.
• Digital-signature services — only when you sign with a trusted timestamp or long-term validation, or click Check revocation online in the Signatures panel. For a timestamp, the App contacts the timestamp server you pick in Sign with certificate (DigiCert by default, or Sectigo, GlobalSign or SSL.com) and sends it a cryptographic fingerprint (hash) of the signature, not the document. For long-term validation and status checks, it downloads revocation lists (CRL), OCSP answers and issuer certificates from the addresses written in the certificates concerned, normally those of the certifying authority; an OCSP request identifies the certificate being checked. Timestamp requests use plain HTTP, and so do CRL, OCSP and issuer-certificate downloads from the http:// addresses that certificates normally contain, as these services are designed to work; their answers are digitally signed, and the App checks those signatures. These requests follow your Windows proxy settings and go to servers run by those companies under their own policies.

None of these requests contains your documents, your licence key, your machine ID or your request code. Every server the App contacts sees your IP address. Like any web server, dl.mokshx.net (served through Cloudflare) records standard request data — IP address, time, the file requested and the app or browser version — which is used only to deliver the files and keep the service secure.

Links in the App, such as Get Pro, Get the AI Pack and See pricing online, open mokshx.net in your web browser. In Activate licence, the Email this code to MokshX button opens your mail app with a message containing your request code and machine ID; nothing is sent until you send it. The WhatsApp button opens a wa.me link in your browser with that message inside the link, so WhatsApp (run by Meta) receives it when the link opens. MokshX has no WhatsApp number yet, so please send your request code by email.

3. The request code and the licence key

To activate a paid plan you send us a request code. It contains only:

• a machine ID — a 16-character code made by hashing the Windows MachineGuid (a random number Windows creates when it is installed) together with a value specific to this App, so it cannot be turned back into the MachineGuid. In the rare case that Windows does not let the App read the MachineGuid, the code is made the same way from the PC's name and the Windows user name (someone who knows or guesses those names could check them against the code);
• a host label — the PC's name as set in Windows (up to 32 characters), so that you and we can tell your PCs apart. If the PC's name includes your own name, we will see it;
• the App version.

It contains no documents, no hardware serial numbers or network (MAC) addresses, and no IP address. The licence key we send back is digitally signed and contains the licence ID, the machine ID, the plan and its features, the issue and expiry dates, and the name given at purchase. It is stored on your PC; please do not publish it.

4. When you buy a licence

Online payment on the buy page is not open yet. Until it opens, licences are bought by email to [email protected], and this section applies to those purchases in the same way.

On the buy page (once online payment opens) or by email, we collect your name or company name, email address, mobile number and GSTIN (optional), the request code(s), the plan and amount, the payment reference (the Razorpay order and payment IDs, or the UPI or bank-transfer reference), and the licence IDs we issue.

• Why: to issue and email your licence key and GST invoice; to support you (reissues, moves to a new PC, refunds); to prevent fraud; and to meet tax and legal obligations. We use it only for these purposes, because you give it to us for the purchase and because the law requires us to keep tax records.
• Online payments are processed by Razorpay under its own privacy policy. Your card, UPI and bank details go to Razorpay, not to us; we receive the payment ID, its status and basic payment details such as the method used.
• Payments by UPI or bank transfer (purchases by email) are made through your own bank or UPI app. We receive what our bank shows us about the payment, such as the payer's name, the UPI ID or account details and the transaction reference.
• Where it is kept: in MokshX's licence and invoicing records, on infrastructure providers such as Cloudflare and our email service providers. They process it only to provide their services to us, and may do so outside India. Access is restricted.
• If you write to us by email, we receive what you send.
• We do not sell or rent personal data and do not use it for advertising.

5. These web pages and cookies

• The Moksh PDF Editor pages on mokshx.net set no cookies and use no analytics or advertising trackers. They load the Inter typeface from Google Fonts, so Google receives your IP address and browser details when the font is fetched.
• The buy page can load Razorpay's checkout script, which may set its own cookies and use similar browser storage for payment security and fraud prevention, under Razorpay's policy.
• The buy page checks your request code, GSTIN and other details in your browser; once online payment opens, they are sent to our server only when you press Pay.

6. How long we keep data

• Invoices, payment records and the licence records linked to them (name, GSTIN, request codes, licence IDs): 8 years, as required under GST and company law.
• Support emails: as long as they are needed to support your licence, then deleted unless the law requires us to keep them.
• Server logs of downloads and update checks: kept for a short time by Cloudflare for delivery and security.

7. Your rights (DPDP Act, 2023)

You can ask us to:

• give you a summary of the personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it — except what we must keep by law, such as invoices and tax records (once your request codes and licence records are erased, we can no longer reissue or move your key);
• stop using it for any purpose you consented to (withdrawal of consent applies from then on);
• record a person who may exercise these rights for you in the event of your death or incapacity (nomination).

Write to [email protected], if possible from the email address you used to buy, with the subject "Privacy request". We may ask you to confirm your identity. If you are not satisfied with our answer, you may, once the relevant provisions of the DPDP Act are in force, complain to the Data Protection Board of India after using our grievance process (section 10).

8. Children

If you are under 18, a parent or guardian should make the purchase and give their own details. The App itself collects no personal data from anyone.

9. Security

Updates, AI models, language packs, the revocation list and these web pages travel over HTTPS. Timestamp, CRL and OCSP requests normally use plain HTTP, as those services are designed to, and their answers are checked against the digital signatures they carry (see section 2). An update installs only if it is signed by MokshX Private Limited; licence keys and the revocation list are digitally signed; every AI model and OCR language pack is checked against its SHA-256 fingerprint before use; and purchase records are stored with access controls.

10. Grievances and contact

Grievance Officer: MokshX Private Limited, C-403, Zee Corporate Park, Vile Parle East, Mumbai – 400057, Maharashtra, India · [email protected] (subject "Grievance"). For anything else, write to [email protected]. We acknowledge every grievance within 48 hours and resolve it within one month of receiving it.

11. Changes

If we change this part of the policy, the new version will be posted here with a new date.