Privacy policy

Files you process in your browser

The light tools — merging, splitting, rotating, reordering and turning images into a PDF — run entirely inside your browser when your files are small enough. Nothing is uploaded, nothing reaches a server of ours, and there is nothing for us to keep. The page tells you when this is what is happening.

Files that need a server

Larger files and the heavier tools — compression, conversion from Office documents, and making a scan searchable — need more than a browser can do. Those files are uploaded to our storage provider through a link that works for one file and expires in fifteen minutes.

We do not use the name of your file. Each upload is stored under a number inside a folder named for the job, so the name you gave it never reaches our storage, our database or our logs. The work itself happens in a container with no network access at all, which is opened for one job and destroyed afterwards.

Files are deleted within two hours of the job finishing, inputs and outputs alike. Storage removes anything older than a day regardless, as a second line. The file retention page sets this out in full.

What we record

For each job we record its identifier, which tool ran, how large the files were, how long the work took and whether it succeeded. None of that includes the name of a file or anything from inside one. We do not read your documents, and no person here can.

To count usage against the daily limit we need to tell one visitor from another. Your IP address is turned into a hash with a secret key and only the hash is stored. The address itself is never written to our database and never written to our logs.

That hash does not stay. A scheduled task removes it from a job 24 hours after the job's files are deleted, and deletes the daily counts after 30 days. What is left is a record that a tool ran and how it went, connected to nobody. A job whose hash has gone cannot be opened again by anyone, including you, so download anything you need while it is there.

Services we rely on

Running the site means other companies handle some of the traffic. Each of them sees only what it needs to:

• Cloudflare delivers the site and protects it from abuse. Like any host, it sees the IP address a request comes from.
• Google AdSense serves the advertising that pays for the site, and only after you have allowed it.
• Cloudflare Turnstile checks that a job is being started by a person rather than a script. It runs when you start a job and reports only whether the check passed.
• Cloudflare R2 stores the files for the tools that need a server, under the scheme described above.
• Sentry receives a report when something in the site fails in a way we did not anticipate. The report names the tool and the error. It does not carry your files, your file names or your address.

Cookies and your choice

Nothing that is not needed to run the tools loads until you have said it may. If you are in Europe or on the west coast of the United States, a banner asks you before anything optional runs, and refusing takes the same one click as accepting.

Until you answer, and for as long as you refuse, no advertising or analytics script is loaded at all. This is not a script that loads and then behaves itself: it is not fetched, so there is nothing to behave.

Your answer is kept in your own browser, not on our servers, and it is not something we can read. Clearing your browser data clears it, and the banner asks again.

Advertising

The site is free and is paid for by advertising. When you allow it, ads are served by Google AdSense, which sets cookies of its own to measure and to limit how often you see the same advertisement. Google's use of that data is governed by its own policies rather than this one.

Ads never appear inside a tool. The advertising script cannot see the files you are working on, because the files are never in the page in a form it could reach and are usually not on our servers at all.

Counting visits

When you allow it, we count page views to know which tools people use. It is aggregate counting rather than a profile of you: no identifier follows you between visits and nothing is sold or shared.

Your rights

If you are in the European Economic Area, the United Kingdom or California, the law gives you rights over personal data held about you: to see it, to correct it, to have it deleted, and to object to its use.

In practice we hold almost nothing to exercise them against. There is no account, and the only record connected to you is a hash of your address that we cannot reverse and that is deleted on the schedule described above. Files are gone within two hours whether or not anybody asks. If you want to make a request anyway, write to us at the address below and we will answer.

Children

The site is not directed at children under 13, and we do not knowingly collect anything from them. Since there is no account and no profile, there is nothing to collect.

Changes

If this policy changes, the date at the top changes with it. A change that affects what we collect or how long we keep it will be said plainly rather than folded into a paragraph.

Contact

Write to TO BE SET: contact email address. The operator of this site is TO BE SET: registered name of the operating entity, TO BE SET: postal address for legal notices.