What we collect, in full

The file you choose is read straight into the page’s own memory and worked on there, using the capabilities the browser already ships: Web Workers, WebAssembly, Canvas and WebCrypto. The result comes back as a temporary in-memory address that is released when you clear the tool or close the tab. There is no step in which the file is sent somewhere and no copy kept afterwards.

That is a claim, so it is tested rather than asserted. The test attempts five different ways of smuggling data out of this site and records that each one is refused, then runs a real file through a real tool and measures the bytes. The protocol, the per-vector result and the limits of what it establishes are on the proof page.

One deliberate exception. The background remover downloads its AI model and WebAssembly runtime from this same site before it can run, so that page is allowed to reach this origin and no other. The download is app code, like the JavaScript and fonts every page fetches. It carries no part of your image, and it travels in the opposite direction.

Asking for a page is a network request; that much is unavoidable on any website. When you request a page — not an image, script or other asset — the edge handler writes one event. This is the whole of it:

Country

From Cloudflare's country header. Coarse only — no region, no city.

Device type

Mobile, tablet or desktop, derived from the user agent. The user agent itself is not stored.

Referrer category

Search engine, social platform or direct. The raw referring URL is not stored.

Page path

Which page was requested, and the tool parameter if the URL carried one.

Browser language

Your primary language only.

Timestamp

When the request arrived.

What that event does not contain

• ×Your IP address
• ×Your city or region
• ×The raw referring URL
• ×Your user agent string
• ×Any cookie — the site sets none
• ×Any file, file name, pasted text or result
• ×Any account, because there are no accounts

Because no address and no identifier is recorded, these events cannot be joined together into a picture of one person. They answer “which pages were opened today, roughly from where” and nothing narrower. Our hosting provider separately keeps its own standard request records, as every host does, on its own retention schedule.

Adding a field to this event without updating the published list is treated as a security vulnerability, not a change of plan. The rule and the field list live in .github/SECURITY.md in the public repository.

Four things, all held by your own browser on your own machine, none of them readable by us. Clearing site data removes every one.

• tools-themeLocal storage

  Whether you chose the light or dark appearance, so the site does not flip back on your next visit.

• tool_usage_countLocal storage

  A running count of how many times you have finished a task, used to decide when to show the support message once. It is a number, not a history: which tools you used is not recorded.

• user_reviewsLocal storage

  Feedback you typed into the review box, kept on your own machine. It is not sent anywhere, which also means nobody but you can read it.

• opentools-handoffIndexedDB

  A file you dropped on the home page, held only long enough to survive the click through to the tool you picked. It is deleted the instant that tool collects it, and anything older than five minutes is discarded on read. This is your own browser’s storage on the machine the file already came from.

Checking any of this yourself

You are not required to take this page on trust, and we would rather you did not.

• •Watch the network. Open your browser’s developer tools, select the Network tab, tick Preserve log, and run a file through any tool. Your document should produce no row at all. The proof page walks through it.
• •Switch the network off. Load a tool, set your developer tools to offline, then process a file. It still works, because there was never anything on the other end.
• •Read the code. The whole site is public and MIT licensed, the storage keys above are the only ones in it, and the tests that keep it that way ship alongside: the repository.

Questions this policy can answer briefly