Your data security is not a feature — it is the foundation. Local-first tools keep processing on your device, and tools that use external services explain that data flow before you use them.
Many file tools run entirely in your browser using client-side JavaScript and WebAssembly. Tools that call external services, including AI tools, identify that requirement before use.
We do not inspect or store tool inputs in our application. AI tools forward your text to a third-party AI provider as disclosed on each tool page — those providers may retain data under their own policies. With consent, analytics may record aggregate events such as page views, downloads, or navigation clicks, but not the contents of files or text.
We collect almost nothing. The only personal data we might hold is your email if you contact us or subscribe to the newsletter. That data is deleted when you unsubscribe or the inquiry is resolved.
All connections are encrypted with TLS. Our HSTS policy enforces HTTPS with a one-year max-age, includeSubDomains, and preload — your data is always encrypted in transit.
Each tool page explains how it processes data — most utilities run locally in your browser, and any tool that relies on an external service discloses that clearly.
Analytics and advertising are only loaded after you explicitly consent in our cookie banner. No tracking scripts run until you opt in. You can change or withdraw consent at any time.
Every response from our servers includes these headers, configured and verified in our Next.js deployment.
| Header | Status |
|---|---|
| Content-Security-Policy (CSP) Restricts which resources the browser can load, preventing cross-site scripting (XSS) and data injection attacks. | Active |
| Strict-Transport-Security (HSTS) Forces all connections over HTTPS with a one-year max-age, includeSubDomains, and preload directive. | Active |
| X-Frame-Options: DENY Prevents the site from being embedded in iframes on other domains, blocking clickjacking attacks. | Active |
| X-Content-Type-Options: nosniff Prevents the browser from MIME-type sniffing, ensuring responses are interpreted as declared content types. | Active |
| Referrer-Policy Limits referrer information to same-origin requests, preventing leaking of page URLs to third parties. | Active |
| Permissions-Policy Disables access to camera, microphone, and geolocation APIs — we never need or request these capabilities. | Active |
| Cross-Origin-Opener-Policy Isolates tool pages to prevent cross-origin window interactions, protecting against Spectre-class attacks. | Tool pages |
| Cross-Origin-Embedder-Policy Enables secure cross-origin resource loading for advanced tool features like WASM-based processing. | Tool pages |
If you discover a security vulnerability, we appreciate responsible disclosure. Please report it by emailing us directly.