Local first. Server when necessary. Account only when necessary.

What "local" means in practice

A local tool loads its processing code into your browser and works on the file in memory — using the Canvas API for images, PDF.js and pdf-lib for documents, Web Workers so the page stays responsive, and WebAssembly builds of codecs where they are faster. When you download the result, the browser writes it straight from memory to your disk. There is no upload step to skip; it simply never existed.

The trade-off is honest: your device does the work, so a 400-page scan on an old phone will be slow. That is why some tools are hybrid.

When a server is involved

Some operations cannot reasonably run in a browser — converting Office documents with layout fidelity, OCR across hundreds of pages, or transcoding long video. For these, the badge says Secure server processing before you start. The production design for that path is:

• Upload to private object storage via a short-lived signed URL. Files are never written to a public bucket and are never indexed.
• Processing on an isolated worker with CPU, memory and time limits, in a container that is discarded afterwards.
• Randomised internal filenames; the name you see is sanitised before it is ever shown back.
• Download via a signed URL that expires. A Delete files now button on every result screen removes inputs and outputs immediately.
• Automatic expiry for anything you do not delete yourself.

What we do not claim

We will not describe encryption certifications, compliance frameworks or guaranteed deletion windows until each one has actually been implemented, tested and — where it matters — independently verified. A privacy page that says "military-grade" tells you nothing; one that says exactly which tools never upload, and how server files are handled, tells you what you need.

Accounts and what they store

Everyday tools never require an account. Favourites, recent tools and theme live in your browser's local storage and nowhere else. An account exists for bulk jobs, saved workflows, processing history and API keys, and stores only what those features need: job metadata (tool, sizes, timing, status), workflow definitions and hashed API tokens. Never file contents.

Analytics

Product analytics, when added, will record high-level events only: a tool was opened, which processing mode ran, whether a job succeeded, and anonymous performance timing. Never uploaded file contents, file names, pasted text, or the inputs to developer and security tools.